barebox CVE-2026-34963

The attacker must be able to deliver a malicious EFI PE binary to a barebox instance (< 2026.04.0) that then parses it through the EFI PE loader in efi/loader/pe.c - specifically via one of the named channels: a TFTP server used for network/PXE boot, a USB device, an SD card, or a network boot flow. The device must actually invoke the EFI PE loader on the attacker-supplied image. Limiting factors: exploitation is local (AV:L) - it requires physical access to the boot media or control of the boot network/TFTP source, not arbitrary remote access; the target must be configured to load EFI PE images from an untrusted source, and secure/verified boot that rejects unsigned binaries would block the untrusted image before parsing. No authentication is required once the attacker can supply the image (PR:N).

Signals are broadly consistent and point to a serious-impact but hard-to-reach issue rather than a mass-exploitation event. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 8.6) reflects full compromise of the vulnerable system with no privileges, but critically AV:L means the attacker needs local access or control of the boot medium/path - not remote internet exploitation. This aligns with CISA SSVC, which rates Exploitation 'none', Automatable 'no', and Technical Impact 'total': high consequence if triggered, but not scalable or currently exploited. EPSS is 0.01% (2nd percentile), and there is no CISA KEV listing and no identified public exploit, so this is not an active-exploitation priority. One note of caution: the description lists TFTP and network boot as delivery vectors, which could imply an adjacent/network path, yet the assigned vector is AV:L - verify the exact reachable configuration with the vendor/VulnCheck advisory before ruling out network exposure. Net: patch promptly on affected embedded fleets, but this is a defense-in-depth fix, not an emergency drop-everything item for most environments.

An attacker with control of a device's boot medium - a crafted USB stick, SD card, or a rogue/compromised TFTP server used for network boot - supplies a malicious EFI PE binary. When barebox's EFI PE loader parses it, the 32-bit size computation overflows and allocates an undersized heap buffer, and the section copy then writes past it, corrupting heap memory and potentially yielding code execution in bootloader context. No public exploit is currently identified, and the local attack vector plus need to reach the EFI loader path makes this an opportunistic/physical-access or trusted-network scenario rather than remote mass exploitation.