CVE-2026-24795
Out-of-Bounds Write in CloverBootloader Oniguruma Module
Publication date: 2026-01-27
Last updated on: 2026-01-27
Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cloverhackycolor | cloverbootloader | to 5162 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an out-of-bounds write issue in the CloverBootloader's function concat_opt_exact_str(), which was cloned from the Oniguruma regular expression library. The function had not received a critical security patch that was applied in Oniguruma, leading to a potential out-of-bounds write that could cause security problems. The vulnerability is related to the regcomp.C program files in CloverBootloader versions before 5162. [1]
How can this vulnerability impact me? :
The out-of-bounds write vulnerability could lead to security issues such as memory corruption, which might be exploited to cause crashes, data corruption, or potentially allow an attacker to execute arbitrary code or escalate privileges within the affected system running CloverBootloader. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update CloverBootloader to version 5162 or later where the security fix has been applied. The fix addresses the out-of-bounds write in the function concat_opt_exact_str() by applying the patch originally from the Oniguruma library. Ensuring your CloverBootloader is patched with this fix will eliminate the vulnerability. [1]