CVE-2026-34963
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In barebox bootloader prior to version 2026.04.0, multiple memory-safety vulnerabilities exist in the EFI PE loader (efi/loader/pe.c). Integer overflow in virtual image size calculation and missing validation of PointerToRawData lead to undersized heap allocation and out-of-bounds heap read. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot, potentially causing heap buffer overflow and code execution in bootloader context.
Risk Assessment
The risk for the organization includes potential takeover of the boot process by delivering a crafted EFI PE file. This could allow malicious code execution before the operating system loads, leading to persistent system compromise and bypass of security mechanisms.
Recommendation
Immediately update barebox bootloader to version 2026.04.0 or later, which includes fixes for these vulnerabilities. In the meantime, restrict access to boot sources (TFTP, USB, SD, network) to trusted devices only.
Other vulnerabilities in barebox
See all- CVE-2026-34962Medium
A denial-of-service vulnerability in barebox prior to version 2026.04.0 allows attackers to cause an infinite loop during directory listing or path resolution by supplying a malicious ext4 filesystem image with a crafted directory entry containing a zero-length value.
- CVE-2026-34961Medium
A vulnerability in barebox prior to version 2026.04.0 allows out-of-bounds reads during ext4 filesystem parsing. Missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c enables attackers to supply a malicious ext4 image via USB, SD card, or network boot.
- CVE-2026-34960Medium
In barebox prior to version 2026.04.0, an out-of-bounds read vulnerability exists in the DHCP option parsing within the dhcp_message_type() function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet without a proper 0xff end marker to cause the parser to read past valid packet data and potentially crash the system.
Original NVD description (English source)
barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section loading logic fails to validate that PointerToRawData plus copied size remains within the PE file buffer. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot to trigger heap buffer overflow or out-of-bounds read from heap memory, potentially achieving code execution in bootloader context.