CVE-2026-50719

6.8 MEDIUM 0.1% exploit odds No fix listed Auth & access Library

What it is

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing modification of SRAM-resident secure boot state prior to the verification decision. An attacker with physical write access to boot media can inject an init-table entry that disables the secure boot check, causing the ROM to accept unsigned or modified first-stage boot code. This has been hardware-validated on a secureboot-enabled T41 device; ROM analysis confirms closely related behavior on T32, T40, and A1.

At a glance

Exploitability: Can be exploited with physical access without logging in. High risk of data exposure, data tampering, service disruption.
Exploit odds: 0.1% chance of exploitation in the next 30 days (EPSS).
Fix: No patch or advisory is linked yet. Look at mitigations or restrict exposure.