CVE-2026-24795
Unknown Unknown - Not Provided
Out-of-Bounds Write in CloverBootloader Oniguruma Module

Publication date: 2026-01-27

Last updated on: 2026-01-27

Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)

Description
Out-of-bounds Write vulnerability in CloverHackyColor CloverBootloader (MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma modules). This vulnerability is associated with program files regcomp.C. This issue affects CloverBootloader: before 5162.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-27
Last Modified
2026-01-27
Generated
2026-06-16
AI Q&A
2026-01-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-24795
EUVD
EUVD-2026-4720
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
cloverhackycolor cloverbootloader to 5162 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds write issue in the CloverBootloader's function concat_opt_exact_str(), which was cloned from the Oniguruma regular expression library. The function had not received a critical security patch that was applied in Oniguruma, leading to a potential out-of-bounds write that could cause security problems. The vulnerability is related to the regcomp.C program files in CloverBootloader versions before 5162. [1]

Impact Analysis

The out-of-bounds write vulnerability could lead to security issues such as memory corruption, which might be exploited to cause crashes, data corruption, or potentially allow an attacker to execute arbitrary code or escalate privileges within the affected system running CloverBootloader. [1]

Mitigation Strategies

To mitigate this vulnerability, update CloverBootloader to version 5162 or later where the security fix has been applied. The fix addresses the out-of-bounds write in the function concat_opt_exact_str() by applying the patch originally from the Oniguruma library. Ensuring your CloverBootloader is patched with this fix will eliminate the vulnerability. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart