CVE-2026-12681
CVE-2026-12681 is a high-severity vulnerability with a CVSS 4.0 base score of 8.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1285.
Key facts
- Severity: High (CVSS 4.0 base score 8.9)
- EPSS exploit prediction: 0% (9th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-38641
- Weakness: CWE-1285
- Published:
- Last modified:
Description
Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended to the trusted SHA256 hash list. A crafted TPM event log could inject arbitrary SHA256 hashes into the verifier's trusted measurement database, enabling a remote attestation verifier to accept a compromised boot state. This issue affects go-attestation: through 0.6.0.
Frequently asked questions
- What is CVE-2026-12681?
- Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended to the trusted SHA256 hash list. A crafted TPM event log could inject arbitrary SHA256 hashes into the verifier's trusted measurement database, enabling a remote attestation verifier to accept a compromised boot state. This issue affects go-attestation: through 0.6.0.
- How severe is CVE-2026-12681?
- CVE-2026-12681 has a CVSS 4.0 base score of 8.9, rated high severity.
- Is CVE-2026-12681 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-12681?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2026-12681 have an EU (EUVD) identifier?
- Yes. CVE-2026-12681 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38641.
- When was CVE-2026-12681 published?
- CVE-2026-12681 was published on 2026-06-24 and last updated on 2026-06-25.
References
- https://github.com/google/go-attestation/commit/b6e905e7ae52937f02b5ca494dd1c6a3ac7a1003
- https://github.com/google/go-attestation/releases/tag/v0.6.1
- https://github.com/google/go-attestation/security/advisories/GHSA-9r4w-jg96-92mv
Other CWE-1285 vulnerabilities
- CVE-2026-33557 — Critical (CVSS 9.1): A possible security vulnerability has been identified in Apache Kafka. By default, the broker property…
- CVE-2025-3755 — Critical (CVSS 9.1): Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric Corporation…
- CVE-2024-36342 — High (CVSS 8.8): Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in…
- CVE-2025-20796 — High (CVSS 7.8): In imgsys, there is a possible out of bounds write due to improper input validation. This could lead to local…
- CVE-2025-7849 — High (CVSS 7.8): A memory corruption vulnerability due to improper error handling when a VILinkObj is null exists in NI LabVIEW that may…
- CVE-2025-7848 — High (CVSS 7.8): A memory corruption vulnerability due to improper input validation in lvpict.cpp exists in NI LabVIEW that may result…