SWUpdate vulnerabilities

2 known vulnerabilities in SWUpdate from Sbabic. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  swupdate: Improper Certificate Validation

  CVE-2026-109399Oct 12, 2026Sbabic

  SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling

• 7.3 High severity

  SWUpdate: Time-of-check Time-of-use (TOCTOU) Race Condition

  CVE-2025-41259Jun 3, 2026Sbabic

  SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update.