EUVD-2026-55827
GHSA-53vg-jq3h-5r52
Severity by source
AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
Local-only vector confirmed; high privileges and complexity required to reach shim dp.c; scope change reflects boot chain disruption beyond OS boundary.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.
AnalysisAI
NULL pointer dereference in the shim application's dp.c library exposes Red Hat Enterprise Linux 7, 8, and 9 systems using UEFI Secure Boot to a local denial-of-service condition. An attacker with high local privileges and the ability to interact with the shim boot path can trigger the missing NULL pointer check, potentially disrupting the boot process. No public exploit code has been identified at time of analysis, and the low CVSS score of 3.9 reflects the constrained attack prerequisites, though the changed scope (S:C) signals that the impact crosses from the shim component into the broader boot environment.
Technical ContextAI
The shim is a small, signed UEFI application deployed as the first stage in Secure Boot chains on Linux systems - it validates subsequent bootloader stages (typically GRUB) before handing off execution. The affected component is dp.c, which handles UEFI device path processing. CWE-476 (NULL Pointer Dereference) indicates that a pointer is dereferenced without a preceding validity check, resulting in a crash or undefined behavior when a NULL or uninitialized pointer is encountered during device path parsing. Because shim executes in the UEFI pre-OS environment, a crash here halts the boot process entirely rather than producing a recoverable OS-level fault. Affected CPEs are cpe:2.3:a:red_hat:red_hat_enterprise_linux_7, _8, and _9 across all variants.
RemediationAI
Monitor https://access.redhat.com/security/cve/CVE-2026-19411 for a patched shim package release from Red Hat; no exact fix version is confirmed in available data at time of analysis. Once a patched package is available, update the shim RPM via standard yum/dnf channels (dnf update shim) and re-enroll the updated shim hash in the UEFI Secure Boot database if required by your firmware. As a compensating control on systems where physical or privileged local access is already restricted, ensure that UEFI firmware password protection and boot order restrictions are enforced, which limits the ability of an attacker to interact with the shim execution path. Disabling Secure Boot is not recommended as a workaround since it eliminates a security boundary rather than addressing the vulnerability. Organizations on RHEL 7 should note its end-of-life status and prioritize migration to RHEL 8 or 9 independently of this CVE.
More in Red Hat Enterprise Linux 7
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today