# CVE-2026-34963: barebox integer overflow and heap overflow in EFI PE loader

Source: https://junglewise.ai/threats/cve-2026-34963-barebox-integer-overflow-and-heap-overflow-in-efi-pe-loader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-07-18  
License: CC BY 4.0 with a link back

CVE-2026-34963 · Severity: high · CVSS 8.4 · Published 2026-05-11

barebox, an open-source bootloader used in embedded systems like automotive and industrial devices, contains memory safety flaws in how it handles EFI executable files. An attacker with physical access or control over the boot media (such as a USB drive or SD card) could provide a specially crafted file that triggers a system crash or allows for unauthorized code execution during the boot process. This could lead to a full compromise of the device before the operating system even starts.

Technologies: [Barebox](https://junglewise.ai/threats/technologies/barebox). Vendors: [Barebox](https://junglewise.ai/threats/vendors/barebox).

## Quick answers

**Is CVE-2026-34963 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34963 being exploited in the wild.

**How severe is CVE-2026-34963?** High severity, with a CVSS score of 8.4, published 11 May 2026.

**Which products and versions are affected?** Barebox prior to 2026.04.0.

**Is there a fix for CVE-2026-34963?** A patch was published on 2026-04-17: barebox version 2026.04.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34963 attacked?** It is attacked with local access or from the adjacent network, in device firmware.

**Am I affected by CVE-2026-34963?** Check whether you run Barebox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple memory-safety vulnerabilities exist in the EFI PE loader within `efi/loader/pe.c`. The first issue involves an integer overflow in the virtual image size computation using 32-bit arithmetic on `VirtualAddress` and size values, leading to an undersized heap allocation. The second issue is a lack of validation in the PE section loading logic, where the loader fails to ensure that `PointerToRawData` plus the copied size remains within the bounds of the PE file buffer. An attacker can exploit these by providing a malicious EFI PE binary via TFTP, USB, SD card, or network boot. Successful exploitation can result in a heap buffer overflow or out-of-bounds read, potentially allowing for arbitrary code execution in the bootloader context. The vulnerabilities were fixed in version 2026.04.0.

## Affected products

- Pengutronix barebox prior to 2026.04.0

## Timeline

- 2026-04-17: patched: barebox version 2026.04.0 released
- 2026-05-11: disclosed: Initial advisory publication

## References

- [https://github.com/barebox/barebox](https://github.com/barebox/barebox)
- [https://github.com/barebox/barebox/releases/tag/v2026.04.0](https://github.com/barebox/barebox/releases/tag/v2026.04.0)
- [https://www.vulncheck.com/advisories/barebox-efi-pe-loader-memory-safety-vulnerabilities](https://www.vulncheck.com/advisories/barebox-efi-pe-loader-memory-safety-vulnerabilities)
- [https://y637f9qq2x.com/posts/barebox-sandbox-vulns/](https://y637f9qq2x.com/posts/barebox-sandbox-vulns/)

## Related threats

- [Das U-Boot and Barebox FIT signature verification bypass](https://junglewise.ai/threats/cve-2026-46728-das-u-boot-and-barebox-fit-signature-verification-bypass)
- [barebox infinite loop in ext4 directory parsing](https://junglewise.ai/threats/cve-2026-34962-barebox-infinite-loop-in-ext4-directory-parsing)
- [barebox out-of-bounds read in ext4 extent parsing](https://junglewise.ai/threats/cve-2026-34961-barebox-out-of-bounds-read-in-ext4-extent-parsing)
- [barebox out-of-bounds read in DHCP option parsing](https://junglewise.ai/threats/cve-2026-34960-barebox-out-of-bounds-read-in-dhcp-option-parsing)
- [barebox FIT signature verification bypass](https://junglewise.ai/threats/cve-2026-33243-barebox-fit-signature-verification-bypass)