EUVD-2026-29524
GHSA-q695-vc4p-4hjx
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local firmware flaw needing existing high privileges (PR:H) and a specific precondition (AC:H); firmware-to-system compromise crosses a trust boundary (S:C) with total C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in the UEFI firmware for the Slim Bootloader may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.
AnalysisAI
Escalation of privilege in Intel's Slim Bootloader UEFI firmware allows a privileged local adversary to trigger an integer overflow (CWE-190) and execute code within the firmware/boot context. Exploitation requires existing high privileges and local access with a specific attack requirement present, but a successful attack fully compromises confidentiality, integrity, and availability of both the vulnerable firmware and the subsequent system. There is no public exploit identified at time of analysis and EPSS probability is negligible (0.01%), consistent with SSVC exploitation status of 'none'.
Technical ContextAI
Slim Bootloader is Intel's open-source, lightweight firmware boot solution (an alternative to full UEFI/coreboot stacks) used to initialize hardware and hand off to a payload/OS on Intel platforms. The root cause is CWE-190 (Integer Overflow or Wraparound): an arithmetic computation in the firmware - likely a size, length, or offset calculation during boot-time parsing or memory handling - wraps around its bounds, producing an undersized allocation or out-of-range access that can be steered into memory corruption. Because this executes in the pre-OS firmware trust domain, corruption there can undermine the platform's chain of trust and every layer that boots above it. The CPE string provided by the intel source is malformed (it embeds the full description as the product token: cpe:2.3:a:n/a:slim_bootloader...), so it does not reliably enumerate exact affected builds and should not be treated as authoritative version data.
RemediationAI
Consult Intel advisory Intel-SA-01425 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01425.html) and update Slim Bootloader to the fixed firmware build published there; an exact fixed version is not stated in the provided data, so apply the patched release identified by Intel (Patch available per vendor advisory - released patched version not independently confirmed here). Because this is boot firmware, remediation means rebuilding/reflashing the platform firmware image and validating boot integrity afterward rather than a simple OS package update. Until the fixed build is deployed, reduce exposure to the required preconditions: restrict and audit privileged/administrative local access (the attack requires PR:H and local access), enforce firmware update signing and secure/verified boot, enable firmware write protection where supported, and use hardware/measured-boot attestation to detect tampering. These controls limit who can reach the vulnerable code path but do not remove the overflow, so applying the vendor firmware update remains the only complete fix; note that reflashing firmware carries operational risk and should be staged and tested to avoid bricking devices.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today