Security - Raspberry Pi

Raspberry Pi designs computers, silicon, boot firmware, and the software that runs on them. This page explains how to report a security vulnerability in any of our products and what happens after you do. It also lists the advisories we have published for issues we have fixed.

Reporting a vulnerability

Email [email protected]. Our contact details are also published in a machine-readable format at /.well-known/security.txt.

To help us triage your report quickly, please include:

The affected product, board revision, or service
The firmware, bootloader, operating system, or application versions you tested
A detailed step-by-step explanation of how to replicate the issue
The security impact, and any proof-of-concept code or logs that demonstrate it

What to expect from us

We will acknowledge your report and confirm that we are investigating it
Once we have investigated, we will tell you whether we have accepted the report and how we have assessed its severity
We will keep you updated while we work on a fix, and let you know when it ships
We will agree on a disclosure date with you
Where an issue warrants one, a CVE will be assigned and an advisory published on this page
With your permission, we will credit you in the acknowledgements below

What is in scope

Raspberry Pi computers, compute modules, and microcontrollers, and the silicon we design
Boot firmware and bootloaders, including the Raspberry Pi 5 and Raspberry Pi Compute Module 5 EEPROM
Raspberry Pi OS
Raspberry Pi Connect and Raspberry Pi Imager
raspberrypi.com and the services we run on its subdomains

What is out of scope

Raspberry Pi Direct (see Shopify Bug Bounty instead)
Raspberry Pi Codecs Store (see BigCommerce instead)

Bug bounty programmes

We occasionally run targeted bug bounty programmes and hacking challenges for specific products. Reports made outside of a running programme are not eligible for a reward, but we still want to hear about them and will credit you in the acknowledgements below.

Currently open:

RP2350 Hacking Challenge 2 — a $20,000 prize for a demonstrated side-channel attack that extracts AES key material from RP2350’s secure boot. Open until midnight UK time on 31 October 2026, or until there is a winning submission. See the announcement and the challenge repository for how to enter.

Our RP2350 Hacking Challenge at DEF CON 2024 has now closed.

Reports we will not action

We will close reports that:

Describe one of HackerOne’s Core Ineligible Findings
Do not include a detailed step-by-step explanation of how to replicate the issue and demonstrate relevant security impact
Have a root cause that is not under our control

Security advisories

We publish advisories here for vulnerabilities we have fixed in our products. Product change notices (PCNs) and compliance documentation are published on the Product Information Portal.

CVE-2026-13199: Insufficient entropy in Raspberry Pi 5’s boot firmware

Affects Raspberry Pi 5 and Raspberry Pi Compute Module 5 running rpi-eeprom before 28.22-1. The boot firmware supplied predictable kaslr-seed and rng-seed values to the kernel, weakening kernel address space layout randomisation.

Fixed in rpi-eeprom 28.22-1, which ships the pieeprom-2026-05-26 firmware release. Update your Raspberry Pi and reboot to apply it.

Full record: CVE-2026-13199 on NVD. Reported by Nozomi Networks Labs, fixed in rpi-eeprom#841.

Raspberry Pi OS CVE list

We scan Raspberry Pi OS every day using Syft and Grype to find publicly known security vulnerabilities from a range of software sources. You can view our current list of known vulnerabilities.

The vulnerability databases these tools rely on change daily, so our scans may occasionally miss an issue. Even so, this list should give you a good understanding of the current security state of our images.

Securing your Raspberry Pi

Please see our security documentation for details.

Acknowledgements

We would like to thank the following security researchers for reporting and helping resolve security vulnerabilities: