{"id":"EUVD-2026-38641","enisaUuid":"61d2c620-13fc-3f5c-beed-83044790b27c","description":"Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended to the trusted SHA256 hash list. A crafted TPM event log could inject arbitrary SHA256 hashes into the verifier\u0027s trusted measurement database, enabling a remote attestation verifier to accept a compromised boot state. This issue affects go-attestation: through 0.6.0.","datePublished":"Jun 24, 2026, 12:49:13 AM","dateUpdated":"Jun 24, 2026, 12:57:35 PM","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","references":"https://github.com/google/go-attestation/security/advisories/GHSA-9r4w-jg96-92mv\nhttps://github.com/google/go-attestation/commit/b6e905e7ae52937f02b5ca494dd1c6a3ac7a1003\nhttps://github.com/google/go-attestation/releases/tag/v0.6.1\n","aliases":"CVE-2026-12681\n","assigner":"Google","epss":0.27,"enisaIdProduct":[{"id":"06484b60-4dfc-3292-b936-edc142a08dee","product":{"name":"go-attestation","vendor":{"name":"Google LLC"}},"product_version":"0 ≤0.6.0"}],"enisaIdVendor":[{"id":"2e371796-d143-3638-a4cc-2ce46fb1887c","vendor":{"name":"Google"}}],"enisaIdVulnerability":[{"id":"d80264fa-6c76-31b5-9bb6-f1c10d5a85ff","vulnerability":{"id":"CVE-2026-12681","description":"Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended to the trusted SHA256 hash list. A crafted TPM event log could inject arbitrary SHA256 hashes into the verifier\u0027s trusted measurement database, enabling a remote attestation verifier to accept a compromised boot state. This issue affects go-attestation: through 0.6.0.","datePublished":"Jun 24, 2026, 12:49:13 AM","dateUpdated":"Jun 24, 2026, 12:57:35 PM","status":"PUBLISHED","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","references":"https://github.com/google/go-attestation/security/advisories/GHSA-9r4w-jg96-92mv\nhttps://github.com/google/go-attestation/commit/b6e905e7ae52937f02b5ca494dd1c6a3ac7a1003\nhttps://github.com/google/go-attestation/releases/tag/v0.6.1\n","enisa_id":"EUVD-2026-38641\n","assigner":"Google","epss":0.27,"dataProcessed":"Nov 7, 2026, 7:23:43 AM","vulnerabilityProduct":[{"id":"76198327-7270-35fc-acae-eea30b6250c2","product":{"name":"go-attestation","vendor":{"name":"Google LLC"}},"product_version":"0 ≤0.6.0"}],"vulnerabilityVendor":[{"id":"432b2287-5e02-3cb5-b74a-135cc5b3be75","vendor":{"name":"Google"}}]}}],"enisaIdAdvisory":[]}