CVE-2026-19411: Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null
A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.
Other sources
NULL-pointer dereference in isremovablemediapath(): when DevicePathToStr() returns NULL (e.g. on EFI pool-allocation failure), the result is passed directly to StrnCaseCmp(), which dereferences it on the first loop iteration and crashes. This is a robustness / defensive-hardening issue -- a missing NULL check on a boot-path helper, rather than an attacker-controlled memory-safety bug.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19411?
CVE-2026-19411 has a severity rating of low, with a score of 3.9.
How do I fix CVE-2026-19411?
To address CVE-2026-19411, ensure that you apply the latest patches to the shim application.
What type of vulnerability is CVE-2026-19411?
CVE-2026-19411 is a null pointer dereference vulnerability found in the shim application.
What might be the impact of CVE-2026-19411?
CVE-2026-19411 could allow attackers to perform a denial of service attack on UEFI bootloader systems.
In which library is CVE-2026-19411 found?
CVE-2026-19411 is found in the dp.c library of the shim application.