Quick answers
- Is CVE-2026-34963 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-34963 being exploited in the wild.
- How severe is CVE-2026-34963?
- High severity, with a CVSS score of 8.4, published 11 May 2026.
- Which products and versions are affected?
- Barebox prior to 2026.04.0.
- Is there a fix for CVE-2026-34963?
- A patch was published on 2026-04-17: barebox version 2026.04.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-34963 attacked?
- It is attacked with local access or from the adjacent network, in device firmware.
- Am I affected by CVE-2026-34963?
- Check whether you run Barebox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Multiple memory-safety vulnerabilities exist in the EFI PE loader within `efi/loader/pe.c`. The first issue involves an integer overflow in the virtual image size computation using 32-bit arithmetic on `VirtualAddress` and size values, leading to an undersized heap allocation. The second issue is a lack of validation in the PE section loading logic, where the loader fails to ensure that `PointerToRawData` plus the copied size remains within the bounds of the PE file buffer. An attacker can exploit these by providing a malicious EFI PE binary via TFTP, USB, SD card, or network boot. Successful exploitation can result in a heap buffer overflow or out-of-bounds read, potentially allowing for arbitrary code execution in the bootloader context. The vulnerabilities were fixed in version 2026.04.0.
Affected products
- Pengutronix barebox prior to 2026.04.0
Timeline
- 2026-04-17: patched: barebox version 2026.04.0 released
- 2026-05-11: disclosed: Initial advisory publication