Cloudanix VulnDB

CVE-2026-50719

Medium · 6.8

CVSS

6.8

EPSS

0.1%

Published

Aug 19, 2026

CISA due date

—

The record

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing modification of SRAM-resident secure boot state prior to the verification decision. An attacker with physical write access to boot media can inject an init-table entry that disables the secure boot check, causing the ROM to accept unsigned or modified first-stage boot code. This has been hardware-validated on a secureboot-enabled T41 device; ROM analysis confirms closely related behavior on T32, T40, and A1.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities