CVE-2026-14296: CWE-347 Improper verification of cryptographic signature in Nordic Semiconductor ASA nRF54H20

The vulnerability CVE-2026-14296 in Nordic Semiconductor ASA's nRF54H20 concerns improper verification of cryptographic signatures (CWE-347) during the boot process when using the Direct XIP update strategy. MCUboot, in its bare upstream configuration, assumes bootability if there is at least one slot per image but may select different slots for different images (e.g., main application and radio image). Consequently, the main application may start the radio image from an unauthenticated slot, bypassing intended signature verification and potentially allowing execution of untrusted code.

This vulnerability can lead to execution of unauthenticated and potentially malicious code on the affected device cores, including the radio core. The CVSS 3.1 score of 7.5 (high) reflects the potential for high confidentiality, integrity, and availability impact. Exploitation requires adjacent network access and high attack complexity with no privileges or user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the Direct XIP update strategy or ensure additional verification mechanisms are in place to prevent execution from unauthenticated slots.