VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 29, 2024· Updated Nov 20, 2025

Shim: out of bounds read when parsing mz binaries

CVE-2023-40551

Description

An out-of-bounds read in Shim's MZ binary parser can crash the boot process or leak sensitive data during early system startup.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

An out-of-bounds read in Shim's MZ binary parser can crash the boot process or leak sensitive data during early system startup.

Vulnerability

An out-of-bounds read flaw exists in the MZ binary format parser within Shim, a first-stage UEFI boot loader. The issue occurs when Shim processes a malformed MZ (DOS) header during Secure Boot chain-loading, reading beyond the intended buffer boundaries. The vulnerability affects Shim versions shipped in various Red Hat Enterprise Linux releases, including 8.6 Extended Update Support, prior to the fixes included in RHSA-2024:2086 [4].

Exploitation

An attacker with the ability to supply or modify a crafted MZ binary during the boot phase (e.g., by placing a malicious EFI executable on the boot medium or through a network boot attack) can trigger the out-of-bounds read. No authentication is required, but the attacker must have a mechanism to influence the data processed by Shim before the system boots the final operating system [2][4].

Impact

Successful exploitation causes a crash (denial of service) or may disclose sensitive memory contents, such as cryptographic material or kernel addresses, that could assist in further attacks against the Secure Boot trust chain. The vulnerability does not directly enable arbitrary code execution, but the information leak may reduce the security guarantees of Secure Boot [2][4].

Mitigation

Red Hat has released updated shim packages in RHSA-2024:2086 for Red Hat Enterprise Linux 8.6 Extended Update Support, with additional updates for other affected variants in RHSA-2024:1903 and RHSA-2024:1959 [1][3][4]. Users should apply the available updates to their systems. There is no known workaround for systems unable to update; for such cases, administrators should restrict physical and network access to the boot process.

References
  1. https://access.redhat.com/errata/RHSA-2024:1903
  2. cve-details
  3. https://access.redhat.com/errata/RHSA-2024:1959
  4. https://access.redhat.com/errata/RHSA-2024:2086

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

38

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.