Ingenic T41/T32/T40/A1 SoC Boot ROM Init Table Parser signature verification

Summaryinfo

A vulnerability, which was classified as very critical, has been found in Ingenic T41, T32, T40 and A1 SoC Boot ROM. Affected is an unknown function of the component Init Table Parser. Performing a manipulation results in signature verification. This vulnerability is identified as CVE-2026-50719. The attack is only possible with local access. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Ingenic T41, T32, T40 and A1 SoC Boot ROM (affected version unknown). This affects an unknown functionality of the component Init Table Parser. The manipulation with an unknown input leads to a signature verification vulnerability. CWE is classifying the issue as CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing modification of SRAM-resident secure boot state prior to the verification decision. An attacker with physical write access to boot media can inject an init-table entry that disables the secure boot check, causing the ROM to accept unsigned or modified first-stage boot code. This has been hardware-validated on a secureboot-enabled T41 device; ROM analysis confirms closely related behavior on T32, T40, and A1.

It is possible to read the advisory at opensensor.io. This vulnerability is uniquely identified as CVE-2026-50719 since 06/05/2026. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/19/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Ingenic

Name

• A1 SoC Boot ROM
• T32
• T40
• T41

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion