{"schemaVersion":3,"id":"CVE-2026-12681","aliases":["UBUNTU-CVE-2026-12681","DEBIAN-CVE-2026-12681","CGA-2qvv-fc7p-jqp4","CGA-3rhg-hr8r-pjxx","CGA-93hr-v9w2-rqc3","CGA-9f29-2p79-xwx5","CGA-cgqp-6h7c-gg9f","CGA-mx92-6g35-66w5","CGA-r7w4-2xxg-jg4h","CGA-x4xj-gmm4-8hwg","CGA-xff2-267x-g8p6","CGA-xxcj-c663-58p9","GHSA-9r4w-jg96-92mv","GO-2026-5298","CGA-2cqf-38fr-rgf4","CGA-34m6-pxr2-xxm9","CGA-48qj-ppfq-fp7x","CGA-4932-473j-qm29","CGA-4w5r-g854-hc2q","CGA-5556-639m-885g","CGA-6hg2-9292-4j45","CGA-6q3r-fhg3-3hc4","CGA-7xc4-886x-5x9v","CGA-8qjv-fmjg-qpgh","CGA-99cv-fc2h-mj8q","CGA-cq29-hrq7-gc42","CGA-cqfp-39qr-ccxw","CGA-fc72-g3rp-r6fm","CGA-fgcf-wr9c-j6xc","CGA-fp3q-4hhp-xcg8","CGA-frv2-r2v2-47p5","CGA-fw76-rm7j-g2w8","CGA-gc68-j8cj-vjv5","CGA-gg65-2vvq-2qvh","CGA-h27c-chmp-h7cg","CGA-j56w-ccvj-v3h3","CGA-jr6c-hg6q-5wm8","CGA-pj5m-7j4j-6g5c","CGA-pph7-827m-2qv7","CGA-qw6g-6mr8-m2hm","CGA-r44x-4gcp-8wh8","CGA-vhvx-hw7m-6h48","CGA-vwgh-64gw-x46j","CGA-w46x-q9p8-m749","CGA-wqh2-j22r-5jf4","CGA-ww2f-hjx2-49vq"],"status":"published","duplicateOf":null,"title":null,"description":"Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended to the trusted SHA256 hash list. A crafted TPM event log could inject arbitrary SHA256 hashes into the verifier's trusted measurement database, enabling a remote attestation verifier to accept a compromised boot state. This issue affects go-attestation: through 0.6.0.","dates":{"published":"2026-06-24T00:49:13.500Z","modified":"2026-06-24T12:57:35.436Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.9,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Debian","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Go","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","exploitability":5.6,"impact":6.7,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00268,"percentile":0.17853,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.07700000000000001,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00191},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00191,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00191,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00191,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00191,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00191,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00191,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00191,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00191,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00191,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00191,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00268,"percentile":0.17853}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00191,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00191,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00191,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00191,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00268,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00268,"percentile":0.17853}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-1285","name":"Improper Validation of Specified Index, Position, or Offset in Input","description":"The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1285.html"}],"affected":[{"vendor":"chainguard","product":"tbot","name":"tbot","label":"tbot","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tbot","purlType":"apk","versions":[{"text":"< 18.9.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.2-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"teleport-17","name":"teleport-17","label":"teleport-17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/teleport-17","purlType":"apk","versions":[{"text":"< 17.7.26-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 17.7.26-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"teleport-17-operator","name":"teleport-17-operator","label":"teleport-17-operator","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/teleport-17-operator","purlType":"apk","versions":[{"text":"< 17.7.26-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 17.7.26-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"teleport-17-tbot","name":"teleport-17-tbot","label":"teleport-17-tbot","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/teleport-17-tbot","purlType":"apk","versions":[{"text":"< 17.7.26-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 17.7.26-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"teleport-18","name":"teleport-18","label":"teleport-18","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/teleport-18","purlType":"apk","versions":[{"text":"< 18.9.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"teleport-18-operator","name":"teleport-18-operator","label":"teleport-18-operator","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/teleport-18-operator","purlType":"apk","versions":[{"text":"< 18.9.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"teleport-18-tbot","name":"teleport-18-tbot","label":"teleport-18-tbot","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/teleport-18-tbot","purlType":"apk","versions":[{"text":"< 18.9.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"teleport-18.6","name":"teleport-18.6","label":"teleport-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/teleport-18.6","purlType":"apk","versions":[{"text":"< 18.6.8-r30","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.6.8-r30","eol":null,"hubHref":null},{"vendor":"chainguard","product":"teleport-18.6-operator","name":"teleport-18.6-operator","label":"teleport-18.6-operator","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/teleport-18.6-operator","purlType":"apk","versions":[{"text":"< 18.6.8-r30","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.6.8-r30","eol":null,"hubHref":null},{"vendor":"chainguard","product":"teleport-operator-fips-16","name":"teleport-operator-fips-16","label":"teleport-operator-fips-16","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/teleport-operator-fips-16","purlType":"apk","versions":[{"text":"< 16.5.18-r20","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 16.5.18-r20","eol":null,"hubHref":null},{"vendor":"chainguard","product":"teleport-operator-fips-17","name":"teleport-operator-fips-17","label":"teleport-operator-fips-17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/teleport-operator-fips-17","purlType":"apk","versions":[{"text":"< 17.7.26-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 17.7.26-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"teleport-operator-fips-18","name":"teleport-operator-fips-18","label":"teleport-operator-fips-18","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/teleport-operator-fips-18","purlType":"apk","versions":[{"text":"< 18.9.2-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 18.9.2-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.2-r1 | < 18.9.2-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"teleport-18.6","name":"teleport-18.6","label":"teleport-18.6","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/teleport-18.6","purlType":"apk","versions":[{"text":"< 18.6.8-r30","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.6.8-r30","eol":null,"hubHref":null},{"vendor":"wolfi","product":"teleport-18.6-operator","name":"teleport-18.6-operator","label":"teleport-18.6-operator","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/teleport-18.6-operator","purlType":"apk","versions":[{"text":"< 18.6.8-r30","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.6.8-r30","eol":null,"hubHref":null},{"vendor":"debian","product":"golang-github-google-go-attestation","name":"golang-github-google-go-attestation","label":"golang-github-google-go-attestation","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/golang-github-google-go-attestation","purlType":"deb","versions":[{"text":"< 0.6.1-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.1-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"golang-github-google-go-attestation","name":"golang-github-google-go-attestation","label":"golang-github-google-go-attestation","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/golang-github-google-go-attestation","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"github.com/google","product":"go-attestation","name":"github.com/google/go-attestation","label":"go-attestation","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/google/go-attestation","purlType":"golang","versions":[{"text":"< 0.6.1","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 0.6.1 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"google","product":"go-attestation","name":"go-attestation","label":"go-attestation","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 0.6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 0.6.0","eol":null,"hubHref":"/vendor/google/go-attestation"}],"affectedCount":18,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/google/go-attestation/security/advisories/GHSA-9r4w-jg96-92mv","label":"github.com/google/go-attestation/security/advisories/GHSA-9r4w-jg96-92mv","hostname":"github.com","tags":["REPORT","Advisory","WEB"]},{"url":"https://github.com/google/go-attestation/commit/b6e905e7ae52937f02b5ca494dd1c6a3ac7a1003","label":"github.com/google/go-attestation/commit/b6e905e7ae52937f02b5ca494dd1c6a3ac7a1003","hostname":"github.com","tags":["REPORT","FIX","WEB"]},{"url":"https://github.com/google/go-attestation/releases/tag/v0.6.1","label":"github.com/google/go-attestation/releases/tag/v0.6.1","hostname":"github.com","tags":["REPORT","WEB"]},{"url":"https://ubuntu.com/security/CVE-2026-12681","label":"ubuntu.com/security/CVE-2026-12681","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12681","label":"www.cve.org/CVERecord?id=CVE-2026-12681","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-12681","label":"security-tracker.debian.org/tracker/CVE-2026-12681","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12681.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12681.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12681","label":"nvd.nist.gov/vuln/detail/CVE-2026-12681","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/google/go-attestation/pull/502","label":"github.com/google/go-attestation/pull/502","hostname":"github.com","tags":["WEB","FIX"]},{"url":"https://github.com/google/go-attestation","label":"github.com/google/go-attestation","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/google/go-attestation/releases/tag/v0.6.0","label":"github.com/google/go-attestation/releases/tag/v0.6.0","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-94VQ-67R2-GWVM"]},"timeline":[{"kind":"published","date":"2026-06-24T00:49:13.500Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-24T12:57:35.436Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":36,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T14:31:10.038Z","stale":false,"partial":false}}