Vulnerability · Published May 11, 2026 · Assigned by VulnCheck

CVE-2026-34963barebox EFI PE Loader Memory Safety Vulnerabilities

High 8.4

In plain English

A high-severity integer overflow in barebox from barebox. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.2%top 95.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section loading logic fails to validate that PointerToRawData plus copied size remains within the PE file buffer. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot to trigger heap buffer overflow or out-of-bounds read from heap memory, potentially achieving code execution in bootloader context.

Affected products (as reported)

Vendor	Product	Versions
barebox	barebox	0 – before 2026.04.0

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/barebox/barebox product
https://github.com/barebox/barebox/releases/tag/v2026.04.0 patch
https://www.vulncheck.com/advisories/barebox-efi-pe-loader-memory-safety-vulnerabilities third-party-advisory
Blog Post technical-description