Vulnerability in sbabic swupdate

[ Description ]Official description

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/sbabic/swupdate
• github.com/sbabic/swupdate/blob/2026.05.1/crypto/swupdate_cms_verify_openssl.c
• github.com/sbabic/swupdate/commit/e66c5640664a31668926a24c0c84b6b6570dc0d9
• groups.google.com/g/swupdate/c/dsoMcGFnEns
• www.vulncheck.com/advisories/swupdate-through-2026.05.1-cms-signature-verification-bypa…