Security - Raspberry Pi

Raspberry Pi designs silicon, computers, boot firmware, and the software that runs on them. This page explains how to report a security vulnerability in any of it and what happens after you do. It also lists the advisories we have published for issues we have fixed.

Reporting a vulnerability

Email [email protected]. Our contact details are also published in machine-readable form at /.well-known/security.txt.

To help us triage your report quickly, please include:

the affected product, board revision, or service
the firmware, bootloader, operating system, or application versions you tested
a detailed step-by-step explanation of how to replicate the issue
the security impact, and any proof-of-concept code or logs that demonstrate it

What to expect from us

We will acknowledge your report and confirm that we are investigating it.
Once we have investigated, we will tell you whether we have accepted the report and how we have assessed its severity.
We will keep you updated while we work on a fix, and let you know when it ships.
We will agree a disclosure date with you.
Where an issue warrants one, a CVE will be assigned and an advisory published on this page.
With your permission, we will credit you in the acknowledgements below.

What is in scope

Raspberry Pi computers, Compute Modules, and microcontrollers, and the silicon we design
Boot firmware and bootloaders, including the Raspberry Pi 5 and Compute Module 5 EEPROM
Raspberry Pi OS and the packages we publish
Raspberry Pi Connect and Raspberry Pi Imager
raspberrypi.com and the services we run on its subdomains

What is out of scope

Raspberry Pi Direct (see Shopify Bug Bounty instead)
Raspberry Pi Codecs Store (see BigCommerce instead)

Bug bounty programmes

We occasionally run targeted bug bounty programmes and hacking challenges against specific products. Reports made outside a running programme are not eligible for a reward, but we still want to hear about them and will credit you in the acknowledgements below.

Currently open:

RP2350 Hacking Challenge 2 — a $20,000 prize for a demonstrated side-channel attack that extracts AES key material from RP2350 secure boot. Open until midnight UK time on 31 October 2026, or until there is a winning submission. See the announcement and the challenge repository for how to enter.

Our RP2350 Hacking Challenge at DEF CON 2024 has now closed.

Reports we will not action

We will close reports that describe one of HackerOne’s Core Ineligible Findings, that do not include a detailed step-by-step explanation of how to replicate the issue and demonstrate relevant security impact, or whose root cause is not under our control.

Security advisories

We publish advisories here for vulnerabilities we have fixed in our products. Product change notices and compliance documentation are published on the Product Information Portal.

CVE-2026-13199: insufficient entropy in Raspberry Pi 5 boot firmware

Affects Raspberry Pi 5 and Compute Module 5 running rpi-eeprom before 28.22-1. The boot firmware supplied predictable kaslr-seed and rng-seed values to the kernel, weakening kernel address space layout randomisation.

Fixed in rpi-eeprom 28.22-1, which ships the pieeprom-2026-05-26 firmware release. Update your Raspberry Pi and reboot to apply it.

Full record: CVE-2026-13199 on NVD. Reported by Nozomi Networks Labs, fixed in rpi-eeprom#841.

Keeping your Raspberry Pi up to date

Most security fixes, including boot firmware updates, reach your device through Raspberry Pi OS package updates. See our documentation on updating software for details.

Acknowledgements

Thanks to the following security researchers for reporting and helping resolve security vulnerabilities: