CVE-2026-19411

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

Red-hat rates this vulnerability as Moderate impact. The vulnerability does not guarantee all times the library is used the same behavior, but it could make the system unstable, allow local denial of service or corrupt both integrity and availability of the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The code could be modified to include NULL pointer checkers in the code. Before DevicePathToStr : "if (li == NULL || li->FilePath == NULL) return 0;" After DevicePathToStr : "if (bootpath == NULL) return 0;" At error: "if (bootpath != NULL)"