CVE-2026-34963: barebox EFI PE Loader Memory Safety Flaws

The National Vulnerability Database has detailed CVE-2026-34963, a critical vulnerability affecting barebox versions prior to 2026.04.0. This flaw resides within the EFI PE loader (efi/loader/pe.c) and stems from multiple memory-safety issues. Specifically, an integer overflow during virtual image size computation, relying on 32-bit arithmetic for section VirtualAddress and size values, leads to undersized heap allocations. Furthermore, the PE section loading logic fails to validate that PointerToRawData plus the copied size remains within the PE file buffer.

These vulnerabilities create a dangerous attack vector. An attacker can craft and supply a malicious EFI PE binary through various means, including TFTP, USB, SD card, or network boot. This malicious input can trigger heap buffer overflows or out-of-bounds reads from heap memory. The primary concern here is the potential for arbitrary code execution within the highly privileged bootloader context.

The CVSSv3.1 score for CVE-2026-34963 is 8.4 (HIGH), reflecting its severe impact. The attack vector is local (AV:L), but requires no privileges (PR:N) and no user interaction (UI:N), making exploitation straightforward once a malicious binary is introduced into the boot process. Successful exploitation grants high confidentiality, integrity, and availability impact (C:H/I:H/A:H), underscoring the critical need for immediate patching.