Memory Safety Vulnerabilities in Barebox EFI PE Loader by Barebox

CVE-2026-34963

What is CVE-2026-34963?

Barebox, an open-source bootloader, is subject to multiple memory safety vulnerabilities in its EFI PE loader. Notably, these vulnerabilities stem from an integer overflow in the calculation of virtual image size using 32-bit arithmetic. This flaw impacts the handling of section VirtualAddress and size values, leading to insufficient heap allocation. Additionally, the PE section loading logic does not properly validate the sum of PointerToRawData and the copied size, which can extend beyond the boundaries of the PE file buffer. An attacker exploiting this vulnerability could deliver a malicious EFI PE binary through various means such as TFTP, USB, SD cards, or network boot, resulting in heap buffer overflows or out-of-bounds reads from heap memory, potentially allowing for unauthorized code execution in the bootloader context.

References