CVE-2026-34963
Memory Safety Flaws in barebox Bootloader
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| barebox | barebox | to 2026.04.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-190 | The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in barebox versions prior to 2026.04.0 and involves multiple memory-safety issues in the EFI PE loader component. Specifically, an integer overflow occurs during the calculation of the virtual image size using 32-bit arithmetic on section VirtualAddress and size values. This leads to an undersized heap allocation. Additionally, the PE section loading logic does not properly validate that the sum of PointerToRawData and the copied size stays within the PE file buffer boundaries.
An attacker can exploit this by supplying a malicious EFI PE binary through various means such as TFTP, USB, SD card, or network boot. This can trigger a heap buffer overflow or an out-of-bounds read from heap memory, potentially allowing the attacker to execute arbitrary code within the bootloader context.
How can this vulnerability impact me? :
This vulnerability can have serious impacts as it allows an attacker to execute arbitrary code in the bootloader context. Since the bootloader runs at a very early stage of system startup with high privileges, successful exploitation could lead to full system compromise, including bypassing security controls, installing persistent malware, or disrupting system boot processes.