nRF54H20: MCUBoot can be tricked to executing unauthenticated code

Description

When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active slot without additional verification. The MCUboot in the bare (upstream) configuration assumes that if there is at least a single slot for each image available, the system is bootable and continues the boot process. This may lead to a situation when MCUboot picks different slot for different images (i.e. (a) for the main application and (b) for the radio image), boots the main application (from slot (a)) that afterwards starts the radio image by providing an address of the unauthenticated slot ((a) instead of (b)).

Scores

EPSS (exploitation in 30 days)

0.17% · top 94% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-347 Improper verification of cryptographic signature (opens in a new tab)All about CWE-347 and its CVEs

Affected products

• Nordic Semiconductor ASA · nRF54H20

  • affected 3.2
  • affected 3.3

References (1)

• https://docs.nordicsemi.com/r/bundle/struct_sa/page/struct/sa.html (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-14296](https://trackcve.app/badge/CVE-2026-14296.svg)](https://trackcve.app/cve/CVE-2026-14296)

Record last updated 8 Sept 2026, 15:00 UTC.