CVE-2026-40003 is an out-of-bounds write vulnerability (CWE-787) in the ZTE ZX297520V3 BootROM. The vulnerability arises from the lack of validation on target addresses during USB download mode, enabling arbitrary memory writes. This can overwrite the stack and alter execution flow, effectively bypassing Secure Boot protections and allowing unauthorized code execution on affected devices using the 7520V3 chip. The CVSS 3.1 base score is 5.1 (AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L), reflecting the attack complexity and partial impact on confidentiality, high impact on integrity, and low impact on availability. There is no vendor-provided patch or remediation guidance at this time.

Successful exploitation allows an attacker with physical access via USB to perform arbitrary memory writes in the BootROM, potentially hijacking execution flow and bypassing Secure Boot signature verification. This can lead to unauthorized code execution at a low privilege level with user interaction required. The impact includes partial loss of confidentiality, high integrity compromise, and low availability impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit physical access to affected devices and disable or restrict USB download mode if possible. Monitor vendor communications for updates on patches or mitigations.