CVE-2026-34963 Details
Description
barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section loading logic fails to validate that PointerToRawData plus copied size remains within the PE file buffer. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot to trigger heap buffer overflow or out-of-bounds read from heap memory, potentially achieving code execution in bootloader context.
A heap buffer overflow vulnerability has been identified in barebox versions prior to 2026.04.0. This issue arises from multiple memory-safety vulnerabilities in the EFI PE loader, specifically in the file efi/loader/pe.c. The vulnerability is caused by an integer overflow in the computation of virtual image size, which is handled using 32-bit arithmetic on section VirtualAddress and size values. This overflow allows for undersized heap allocations. Additionally, the PE section loading logic fails to properly validate that PointerToRawData plus the copied size remains within the bounds of the PE file buffer. An attacker can exploit this vulnerability by supplying a malicious EFI PE binary through TFTP, USB, SD card, or network boot. This could lead to an out-of-bounds read from heap memory or a heap buffer overflow, potentially allowing for code execution within the context of the bootloader.
Users can upgrade to barebox version 2026.04.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pengutronix barebox | < 2026.04.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 18, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | New CVE Received | [email protected] |