CVE-2026-12681

The record

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended to the trusted SHA256 hash list. A crafted TPM event log could inject arbitrary SHA256 hashes into the verifier's trusted measurement database, enabling a remote attestation verifier to accept a compromised boot state. This issue affects go-attestation: through 0.6.0.

Affected packages

Related vulnerabilities

• CVE-2026-107821 MariaDB server is a community developed fork of MySQL server. CWE-1285
• CVE-2026-31912 libpcap BPF interpreter detects neither reaching the end of the filter program buffer due… CWE-1285
• CVE-2026-14479 A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser… CWE-1285
• CVE-2026-18485 There is a local privilege escalation vulnerability recently discovered in the NI-PAL… CWE-1285
• CVE-2026-8036 Improper input validation in NI-PAL may allow a local authenticated user to access… CWE-1285
• CVE-2026-45352 cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. CWE-1285
• CVE-2026-9100 The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the… CWE-1285
• GHSA-w5hq-g745-h8pq uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided CWE-1285