CVE-2026-34963 - Vulnerability Analysis

Overview

barebox prior to 2026.04.0 contains memory-safety vulnerabilities caused by integer overflow and improper validation in EFI PE loader, letting attackers supply malicious EFI PE binaries to trigger heap buffer overflow or out-of-bounds read, potentially achieving code execution in bootloader context.

Severity & Score

Impact

Attackers can execute arbitrary code in the bootloader context, potentially compromising system boot integrity.

Mitigation

Update to version 2026.04.0 or later.

References

• https://github.com/barebox/barebox
• https://github.com/barebox/barebox/releases/tag/v2026.04.0
• https://www.vulncheck.com/advisories/barebox-efi-pe-loader-memory-safety-vulnerabilities

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner