Nordic Semiconductor ASA vulnerabilities
Published CVEs affecting Nordic Semiconductor ASA products: 3 record(s), with severity, exploitation and fixes.
CVE-2026-18796
Medium · 6.8
CWE-1342 Sep 7, 2026
QSPI flash encryption side-channel leakage
Any application that
uses external QSPI flash for encrypted XIP on nRF5340 and relies on that
encryption for confidentiality and/or integrity of the externally stored
code. No specific nRF Connect SDK version is the root cause; the weakness
is in the on-the-fly decryption scheme.
CVE-2026-14297
High · 8.7
CWE-787 Sep 7, 2026
The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixed 20-byte BSS buffer.
A buffer overflow in the Bluetooth Continuous Glucose
Monitoring Service (CGMS) Record Access Control Point (RACP) write handler
allows an authenticated BLE peer to overflow a 20-byte static buffer into
adjacent BSS memory. The exploitable impact cannot be predetermined - it
is entirely dependent on the linker-assigned BSS layout of the specific
firmware build, which may vary.
CVE-2026-14296
High · 7.5
CWE-347 Sep 7, 2026
nRF54H20: MCUBoot can be tricked to executing unauthenticated code
When using the Direct XIP
update strategy, the main application image starts other cores (i.e. radio
core), based on the currently active slot without additional verification. The
MCUboot in the bare (upstream) configuration assumes that if there is at least
a single slot for each image available, the system is bootable and continues
the boot process. This may lead to a situation when MCUboot picks different
slot for different images (i.e. (a) for the main application and (b) for the
radio image), boots the main application (from slot (a)) that afterwards starts
the radio image by providing an address of the unauthenticated slot ((a)
instead of (b)).