{"id":"CVE-2026-109399","summary":"SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates","details":"SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.","modified":"2026-10-14T07:02:31.084957195Z","published":"2026-10-12T15:16:44.440Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-295"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109399.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109399.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109399"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/swupdate-through-2026.05.1-cms-signature-verification-bypass-via-embedded-intermediates"},{"type":"FIX","url":"https://github.com/sbabic/swupdate/commit/e66c5640664a31668926a24c0c84b6b6570dc0d9"},{"type":"PACKAGE","url":"https://github.com/sbabic/swupdate"},{"type":"ARTICLE","url":"https://github.com/sbabic/swupdate/blob/2026.05.1/crypto/swupdate_cms_verify_openssl.c"},{"type":"ARTICLE","url":"https://groups.google.com/g/swupdate/c/dsoMcGFnEns"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sbabic/swupdate","events":[{"introduced":"0"},{"fixed":"9000ecb52677da7d9676a61b729bab57dba99674"},{"fixed":"e66c5640664a31668926a24c0c84b6b6570dc0d9"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"2026.05.1"}]}}],"versions":["2025.12","2025.05","2024.12","2024.05.2","2024.05","2023.12.1","2023.12","2023.05","2022.12","2022.05","2021.11","2021.04","2020.11","2020.04","2020.04-rc2","2020.04-rc1","2019.11","2019.11-rc1","2019.04","2019.04-rc1","2018.11","2018.11-rc1","2018.03","2018.03-rc1","2017.11","2017.07","2017.07-rc1","2017.04","2017.04-rc2","2017.04-rc1","2017.01","2017.01-rc1","2016.10","2016.10-rc1","2016.07","2016.07-rc3","2016.04","2016.04-rc1","2015.07","2014.07"],"database_specific":{"vanir_signatures":[{"digest":{"function_hash":"99802814471114232091222288260174595927","length":1277},"id":"CVE-2026-109399-3b9b7c88","signature_type":"Function","signature_version":"v1","source":"https://github.com/sbabic/swupdate/commit/e66c5640664a31668926a24c0c84b6b6570dc0d9","target":{"function":"openssl_cms_verify_file","file":"crypto/swupdate_cms_verify_openssl.c"},"deprecated":false},{"source":"https://github.com/sbabic/swupdate/commit/e66c5640664a31668926a24c0c84b6b6570dc0d9","target":{"file":"crypto/swupdate_cms_verify_openssl.c"},"deprecated":false,"digest":{"line_hashes":["253780004218998244180158764599123050743","27909323336340585738616014031753920314","255378846703955429197468271652729732151","42411326248752732421032269485355189895","245447065769167807011382437253220602104","168154079082747109629301331100819004246","442667799276524998080685203436406168","16917437262173101105043893965429904919","230519702706190606253488329177100382243","108632204891208769763572761506482123465","301281058260735907764271911668191948826","255773589635677704853282807563083471078","327274814017889380868282711972541787621","60255760831286091237432165077716760481","2790998237843039285543382244667475025","34317222076138748161288059568737208746","141086084863644303516205450463305866678","262035361174700138356776415833556076629","293905963165034859210746627150685161954","334804067047338813805460294892750920165","131653357935290966417162442837065526914","24003336437452824156627227696921015766","160535121033635519949813213374719949190","147890596171450385942101356687946124386","109012457875104728754490173831755169912","65161608457873215749978378256574563425","232140101387067267402458500131180634478","99317853221238149562955401054326121116","17949501504553802794078845524977926098","197825630108359250941406903674727297974","16722988320200991550939940869485549310","178960911026378277316657285905131822295","69156507821638884673433156632481209829","53110275712911930935436224299190281692","157445240408735625024229478306513259359"],"threshold":0.9},"id":"CVE-2026-109399-42874ba7","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/sbabic/swupdate/commit/e66c5640664a31668926a24c0c84b6b6570dc0d9","target":{"file":"crypto/swupdate_cms_verify_openssl.c","function":"check_verified_signer"},"deprecated":false,"digest":{"function_hash":"9658556935862751931226300329695162123","length":993},"id":"CVE-2026-109399-96fb27e4","signature_type":"Function"}],"vanir_signatures_modified":"2026-10-14T07:02:31Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109399.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}