Every CVE Search/ Get API key

CVE-2026-19411

Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null

3.9 Low

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.13%Unchanged since Aug 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.9

Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

Record
CVE-2026-19411
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2026-55827 3.9

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

Record
EUVD-2026-55827
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-53vg-jq3h-5r52 3.9

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A...

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

Record
GHSA-53vg-jq3h-5r52
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
Weakness
CWE-476
Updated
2026-11-02
NVD 3.9

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

Record
CVE-2026-19411
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
Weakness
CWE-476
Updated
2026-11-02
OSVDEBIAN-CVE-2026-19411 3.9

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

Record
DEBIAN-CVE-2026-19411
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-19411 3.9

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

Record
UBUNTU-CVE-2026-19411
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
Updated
2026-11-02
OSVAZL-95634 No score

CVE-2026-19411 affecting package shim-unsigned-aarch64 16.1-2

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

Record
AZL-95634
Updated
2026-11-05
OSVAZL-95637 No score

CVE-2026-19411 affecting package shim-unsigned-x64 16.1-2

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

Record
AZL-95637
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
shim-unsigned-aarch64
Azure Linux:3
 through 16.1-2 None known
shim-unsigned-x64
Azure Linux:3
 through 16.1-2 None known
shim
Debian:12
 All versions, plus listed versions
15.7-115.8-115.8-1~deb10u115.8-1~deb11u115.8-1~deb12u1
Show 4 moreShow less
16.1-116.1-216.1-2~deb12u116.1-2~deb13u1
 None known
shim
Debian:13
 All versions, plus listed versions
15.8-116.1-116.1-216.1-2~deb12u116.1-2~deb13u1
 None known
shim
Debian:14
 All versions, plus listed versions
15.8-116.1-116.1-216.1-2~deb12u116.1-2~deb13u1
 None known
secureboot-db
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.11.4~ubuntu0.14.04.1
 None known
shim
Ubuntu:14.04:LTS
 All versions, plus listed versions
0.4-0ubuntu40.8-0ubuntu20.9+1474479173.6c180c6-1ubuntu113-0ubuntu2
 None known
shim-signed
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.31.41.51.61.9
Show 8 moreShow less
1.17~14.04.11.18~14.04.11.19~14.04.11.32~14.04.21.33.1~14.04.21.33.1~14.04.31.33.1~14.04.41.33.1~14.04.5
 None known
secureboot-db
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.11.4~ubuntu0.16.04.1
 None known
shim
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.8-0ubuntu20.9+1474479173.6c180c6-1ubuntu113-0ubuntu215+1533136590.3beb971-0ubuntu115+1552672080.a4a1fbe-0ubuntu215.4-0ubuntu7
 None known
Show 19 moreShow less
Affected packages
PackageAffectedFixed
shim-signed
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.111.121.17~16.04.11.18~16.04.11.19~16.04.1
Show 10 moreShow less
1.27~16.04.11.28~16.04.11.32~16.04.11.33.1~16.04.11.33.1~16.04.21.33.1~16.04.31.33.1~16.04.41.33.1~16.04.51.33.1~16.04.61.33.1~16.04.10
 None known
secureboot-db
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.11.4~ubuntu0.18.04.1
 None known
shim
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.9+1474479173.6c180c6-1ubuntu113-0ubuntu215+1533136590.3beb971-0ubuntu115+1552672080.a4a1fbe-0ubuntu215.4-0ubuntu715.4-0ubuntu915.7-0ubuntu1
 None known
shim-signed
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.321.33.11.34.41.34.51.34.6
Show 13 moreShow less
1.34.71.34.81.34.91.34.9.11.34.9.21.37~18.04.11.37~18.04.21.37~18.04.31.37~18.04.61.37~18.04.81.37~18.04.101.37~18.04.111.37~18.04.13
 None known
secureboot-db
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.51.6~20.04.1
 None known
shim
Ubuntu:20.04:LTS
 All versions, plus listed versions
15+1533136590.3beb971-0ubuntu115+1552672080.a4a1fbe-0ubuntu115+1552672080.a4a1fbe-0ubuntu215.4-0ubuntu715.4-0ubuntu915.7-0ubuntu115.8-0ubuntu1
 None known
shim-signed
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.391.401.40.31.40.41.40.6
Show 4 moreShow less
1.40.71.40.91.40.101.41
 None known
secureboot-db
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.8
 None known
shim
Ubuntu:22.04:LTS
 All versions, plus listed versions
15.4-0ubuntu915.7-0ubuntu115.8-0ubuntu1
 None known
shim-signed
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.511.51.31.51.4
 None known
secureboot-db
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.81.91.9build1
 None known
shim
Ubuntu:24.04:LTS
 All versions, plus listed versions
15.7-0ubuntu115.8-0ubuntu1
 None known
shim-signed
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.561.571.58
 None known
secureboot-db
Ubuntu:26.10
 All versions, plus listed versions
1.9build2
 None known
shim
Ubuntu:26.10
 All versions, plus listed versions
15.8-0ubuntu2
 None known
shim-signed
Ubuntu:26.10
 All versions, plus listed versions
1.59
 None known
secureboot-db
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.9build11.9build2
 None known
shim
Ubuntu:26.04:LTS
 All versions, plus listed versions
15.8-0ubuntu2
 None known
shim-signed
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.59
 None known

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-19411 is a low vulnerability (CVSS 3.9) in Red Hat Enterprise Linux 7, published August 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open