Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section loading logic fails to validate that PointerToRawData plus copied size remains within the PE file buffer. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot to trigger heap buffer overflow or out-of-bounds read from heap memory, potentially achieving code execution in bootloader context.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-11 | 1 | Patch1 |
| 2026-05-12 | 1 | Disclosure1 |
CVE-2026-34963 Memory Safety Vulnerabilities in barebox EFI PE Loader Prior to 2026.04.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34963
Post summary
The post announces a memory safety vulnerability in barebox EFI PE Loader before version 2026.04.0 (CVE-2026-34963) with no evidence of exploitation, PoC, or patch details.
🚨 CVE-2026-34963: barebox <2026.04.0 EFI PE loader integer overflow permits heap buffer overflow via malicious EFI binary. Code execution in bootloader context achievable. Patch immediately. https://0x2ed3bb60.xyz/threat/0d26e3355fe43872
Post summary
CVE‑2026‑34963 involves an integer overflow in barebox's EFI PE loader, enabling a heap buffer overflow and code execution in bootloader context. Patches are available and urgently recommended.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pengutronix | barebox | - | - | - |