{"id":"CVE-2026-55309","kind":"vulnerability","aliases":["CVE-2026-55309"],"related":[],"title":"Secure boot verifier: fault injection bypasses signature checks, enabling local privilege escalation","description":"In multiple functions of verifier.rs, there is a possible way to bypass secure boot signature verification via fault injection due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"Multiple functions in verifier.rs contain a logic error that lets fault injection bypass secure boot signature verification. A local attacker could use this to escalate privileges without extra execution rights.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","secure-boot"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:12+00:00","first_seen_at":"2026-11-10T20:46:05+00:00","triaged_at":"2026-11-10T20:54:07+00:00","updated_at":"2026-11-10T20:54:07+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:54:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Secure boot verifier: fault injection bypasses signature checks, enabling local privilege escalation","impact":"high","summary":"Multiple functions in verifier.rs contain a logic error that lets fault injection bypass secure boot signature verification. A local attacker could use this to escalate privileges without extra execution rights.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["secure-boot","embedded"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker bypasses secure boot and escalates privileges locally","analyst_note":"Identify the vendor and product containing verifier.rs, the affected versions, and any fix, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-55309.","how_to_check":"unknown","plain_action":"","product_name":"verifier.rs","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected product or firmware version. Teams running devices that use this verifier code should check their vendor's advisories. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000677,"input_tokens":4527,"output_tokens":449,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-55309':15A,18A 'addit':88C 'attack':43B 'boot':2A,23B,38B,67C 'bypass':6A,36B,65C 'check':8A 'contain':28B 'could':44B,79C 'cve':13A,16A 'due':73C 'embed':19B 'enabl':9A 'error':31B,77C 'escal':12A,48B,83C 'execut':52B,89C 'exploit':98C 'extra':51B 'fault':4A,34B,71C 'function':25B,56C 'infrastructur':20B 'inject':5A,35B,72C 'interact':93C 'lead':80C 'let':33B 'local':10A,42B,82C 'logic':30B,76C 'multipl':24B,55C 'need':91C,96C 'possibl':62C 'privileg':11A,49B,85C,90C 'right':53B 'secur':1A,22B,37B,66C 'secure-boot':21B 'signatur':7A,39B,68C 'use':45B 'user':92C 'verif':40B,69C 'verifi':3A 'verifier.rs':27B,58C 'via':70C 'way':63C 'without':50B","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected product or firmware version. Teams running devices that use this verifier code should check their vendor's advisories. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","infrastructure","secureboot","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-55309':15A,18A 'boot':2A 'bypass':6A 'check':8A 'cve':13A,16A 'enabl':9A 'escal':12A 'fault':4A 'inject':5A 'local':10A 'privileg':11A 'secur':1A 'signatur':7A 'verifi':3A","search_b":"'attack':43B 'boot':23B,38B 'bypass':36B 'contain':28B 'could':44B 'embed':19B 'error':31B 'escal':48B 'execut':52B 'extra':51B 'fault':34B 'function':25B 'infrastructur':20B 'inject':35B 'let':33B 'local':42B 'logic':30B 'multipl':24B 'privileg':49B 'right':53B 'secur':22B,37B 'secure-boot':21B 'signatur':39B 'use':45B 'verif':40B 'verifier.rs':27B 'without':50B","search_c":"'addit':88C 'boot':67C 'bypass':65C 'could':79C 'due':73C 'error':77C 'escal':83C 'execut':89C 'exploit':98C 'fault':71C 'function':56C 'inject':72C 'interact':93C 'lead':80C 'local':82C 'logic':76C 'multipl':55C 'need':91C,96C 'possibl':62C 'privileg':85C,90C 'secur':66C 'signatur':68C 'user':92C 'verif':69C 'verifier.rs':58C 'via':70C 'way':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55309","severity":null,"published_at":"2026-11-10T20:19:12+00:00","modified_at":"2026-11-10T20:19:12+00:00","first_seen_at":"2026-11-10T20:46:05+00:00","fetched_at":"2026-11-10T20:46:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}