CVE-2026-14296

CVE-2026-14296 is an improper verification of a cryptographic signature (CWE-347) in MCUboot, the open-source secure bootloader for embedded devices, when it is used in its bare (upstream) configuration with the Direct XIP update strategy on multi-core systems. When MCUboot selects slots for the main application and a secondary core such as the radio core, it may choose different slots for each image; it boots the main application from its slot and passes that slot's address to the application, which then starts the radio core from that slot without additional verification. As a result, the radio core can be started from a slot whose image has not been authenticated, potentially allowing unverified or mismatched firmware to run on that core; the CVSS 3.1 score of 7.5 (AV:A/AC:H) indicates an attacker with adjacent access could exploit this, though the high attack complexity makes practical exploitation difficult. Affected products are deployments of upstream MCUboot using Direct XIP on devices with secondary cores; specific versions are not provided in the available data. No public proof-of-concept or known exploitation exists; EPSS is 0.1% and the issue is not in CISA KEV.

What to do: If your firmware uses upstream MCUboot with the Direct XIP update strategy on a multi-core SoC, audit whether the main application starts secondary cores from a slot address supplied at boot without verifying that slot's image, and add verification (or image-pairing checks) before starting the radio core, or consider a different update strategy. Apply the official fix from the MCUboot project or your SDK vendor as soon as a patched release is identified, since the available data lists no fixed version. Monitor the MCUboot project and NVD for updated advisories and patch information.