CVE-2026-34963 barebox EFI PE Loader Memory Safety Vulnerabilities
An attacker can achieve code execution in the bootloader context by supplying a malicious EFI PE binary that triggers a heap buffer overflow via integer overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34963?
CVE-2026-34963 is a high-severity vulnerability in barebox, published on 11 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section loading logic fails to validate that PointerToRawData plus copied size remains within the PE file buffer. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot to trigger heap buffer overflow or out-of-bounds read from heap memory, potentially achieving code execution in bootloader context.
Weakness: CWE-190
Which versions are affected by CVE-2026-34963?
It affects 1 product.
Products include Pengutronix Barebox.
How do I fix CVE-2026-34963?
No fix has been published for CVE-2026-34963 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-34963 being exploited?
There is no known exploitation of CVE-2026-34963 in the wild and no public exploit code.
Other vulnerabilities in barebox
Sources
Also known as GHSA-qj4w-p892-c352.