The vulnerability in Google go-attestation (CVE-2026-12681) arises from improper validation of specified index, position, or offset in input within the parseEfiSignatureList() function. Specifically, the function does not advance the buffer past vendor bytes before processing entries. For hashSHA256SigGUID lists, this enables an attacker to inject attacker-controlled vendor header bytes appended to the trusted SHA256 hash list. Consequently, a crafted TPM event log can insert arbitrary SHA256 hashes into the verifier's trusted measurement database, allowing a remote attestation verifier to mistakenly accept a compromised boot state. This affects go-attestation versions prior to 0.6.1.

An attacker can exploit this vulnerability to inject arbitrary SHA256 hashes into the trusted measurement database used by remote attestation verifiers. This can cause the verifier to accept a compromised boot state as trusted, undermining the integrity guarantees of the attestation process. The vulnerability has a high CVSS 4.0 score of 8.9, indicating significant potential impact on system trustworthiness and security.

No official patch or remediation level has been published yet. The affected versions are all go-attestation releases prior to 0.6.1. Users should upgrade to version 0.6.1 or later once available. Until then, monitor the vendor advisory for updates and avoid relying on vulnerable versions for critical attestation tasks.