A vulnerability in the on-the-fly decryption scheme used for encrypted XIP on nRF5340 devices that rely on external QSPI flash may allow confidentiality and/or integrity impacts on externally stored code. The issue arises from the specific implementation of the decryption scheme, which could be exploited under certain conditions. This vulnerability affects applications that use external QSPI flash for enc [truncated]
HIGHNordic Semiconductor ASACVE published 2026-09-07
A buffer overflow vulnerability exists in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler, allowing an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The impact of exploitation depends on the linker-assigned BSS layout of the specific firmware build. This vulnerability affects Bluetooth-enabled devices using [truncated]
HIGHNordic Semiconductor ASACVE published 2026-09-07
PatchSiren debrief for CVE-2026-14296: when using the Direct XIP update strategy, MCUboot in bare configuration may pick different slots for main application and radio image, leading to unauthenticated radio image boot. This occurs because MCUboot assumes a system is bootable if at least one slot for each image is available. The main application image starts other cores, such as the radio core, based on t [truncated]
