Executive Summary

This vulnerability exists in barebox versions prior to 2026.04.0 and involves multiple memory-safety issues in the EFI PE loader component. Specifically, an integer overflow occurs during the calculation of the virtual image size using 32-bit arithmetic on section VirtualAddress and size values. This leads to an undersized heap allocation. Additionally, the PE section loading logic does not properly validate that the sum of PointerToRawData and the copied size stays within the PE file buffer boundaries.

An attacker can exploit this by supplying a malicious EFI PE binary through various means such as TFTP, USB, SD card, or network boot. This can trigger a heap buffer overflow or an out-of-bounds read from heap memory, potentially allowing the attacker to execute arbitrary code within the bootloader context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts as it allows an attacker to execute arbitrary code in the bootloader context. Since the bootloader runs at a very early stage of system startup with high privileges, successful exploitation could lead to full system compromise, including bypassing security controls, installing persistent malware, or disrupting system boot processes.

Useful 0 Not Useful 0