---
id: CVE-2026-50719
title: >-
  The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and
  execute an attacker-controlled init table from the SPL header before checking
  the secure boot state and before invoking signature verification
summary: >-
  The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and
  execute an attacker-controlled init table from the SPL header before checking
  the secure boot state and before invoking signature verification. The init
  table pa…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-284
  - CWE-347
  - CWE-474
published: '2026-08-19'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T16:04:24.933'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50719'
references:
  - url: 'https://opensensor.io/security/ingenic-t32-t40-t41-a1-init-table-bypass'
    label: cve@mitre.org
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-24T20:01:10.334363Z'
ingestedAt: '2026-09-10T19:28:32.221Z'
epss: 0.00105
epssPercentile: 0.01202
---

## Overview

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing modification of SRAM-resident secure boot state prior to the verification decision. An attacker with physical write access to boot media can inject an init-table entry that disables the secure boot check, causing the ROM to accept unsigned or modified first-stage boot code. This has been hardware-validated on a secureboot-enabled T41 device; ROM analysis confirms closely related behavior on T32, T40, and A1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.