shim UEFI bootloader CVE-2026-19411

Exploitation requires local access with high privileges (PR:H per CVSS vector) to interact with the shim execution environment during UEFI boot. The vulnerability is triggered in the dp.c device path processing component of the shim application, meaning the attacker must be able to influence device path data evaluated by shim - this typically implies physical access to the machine or root-level OS access to modify EFI variables or boot entries before a reboot. High attack complexity (AC:H) further indicates that specific timing or environmental conditions must be met. Exploitation is limited to systems actively using the shim application for UEFI Secure Boot; systems booting via legacy BIOS or using a different bootloader chain are not affected. There is no remote attack path - AV:L confirms local-only exposure.

The provided CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L) yields a base score of 3.9, appropriately reflecting the highly constrained exploitation conditions: local access only, high attack complexity, and high privilege requirements. No EPSS score was supplied, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. No POC code has been identified. The changed scope (S:C) is the most notable signal - a successful trigger in the shim's pre-OS environment affects the boot chain beyond the shim itself, potentially preventing the OS from loading. In practice, an attacker would already need root-equivalent or physical access to interact with the UEFI/shim layer, which significantly limits the real-world threat surface. This is a low-priority issue for most environments: high-CVSS-adjacent scope change, but constrained by prerequisites that most threat actors would not need to exploit when they already hold high privileges.

A local attacker with root privileges on a RHEL 7/8/9 system - or with physical access to the machine - manipulates device path data processed by the shim's dp.c library during the UEFI boot sequence in a way that triggers the unguarded NULL pointer dereference, causing a shim crash. The crash halts the boot process, rendering the system unavailable until a recovery procedure (live media, rescue mode) is performed. No public exploit code exists, and the scenario requires pre-existing high privilege, making opportunistic exploitation unlikely.