EUVD-2026-29347
GHSA-qj4w-p892-c352
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs local control of boot media/path (AV:L) but no auth (PR:N) or interaction; memory corruption in bootloader yields full C/I/A within the same component (S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section loading logic fails to validate that PointerToRawData plus copied size remains within the PE file buffer. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot to trigger heap buffer overflow or out-of-bounds read from heap memory, potentially achieving code execution in bootloader context.
AnalysisAI
Memory corruption in the barebox bootloader's EFI PE loader (efi/loader/pe.c) affects all versions prior to 2026.04.0, allowing an attacker who can supply a malicious EFI PE binary to trigger a heap buffer overflow or heap out-of-bounds read and potentially execute code in bootloader context. The flaw stems from a 32-bit integer overflow when computing the virtual image size and from missing bounds validation during PE section copy. No public exploit identified at time of analysis and EPSS is very low (0.01%, 2nd percentile), consistent with CISA SSVC rating exploitation as 'none', though the technical impact is rated total. Reported by VulnCheck; a vendor patch is available.
Technical ContextAI
barebox is a bootloader for embedded systems (maintained by Pengutronix, U-Boot's spiritual successor) that can load and execute UEFI/EFI PE (Portable Executable) images. The vulnerability lives in its EFI PE loader, efi/loader/pe.c. The root cause is CWE-190 (Integer Overflow): the loader computes the total virtual image size by summing each section's VirtualAddress and virtual size using 32-bit arithmetic, which can wrap around and produce a value smaller than the real image, leading to an undersized heap allocation. Compounding this, the section-loading logic copies each section from the file using PointerToRawData plus a copied length without validating that this range stays within the bounds of the loaded PE file buffer. Together these produce a heap buffer overflow on write (overrunning the too-small allocation) and an out-of-bounds read from heap memory.
RemediationAI
Vendor-released patch: 2026.04.0 - upgrade barebox to v2026.04.0 or later, available at https://github.com/barebox/barebox/releases/tag/v2026.04.0 (see the migration guide at https://barebox.org/doc/latest/migration-guides/migration-2026.04.0.html). Where an immediate rebuild is not possible, apply compensating controls: disable or do not use the EFI PE loader / EFI boot path if the platform does not require chainloading EFI images; restrict the boot sources the device will accept - disable network/TFTP boot and PXE where not needed (trade-off: breaks netboot-based provisioning and development workflows), and physically secure or lock down USB and SD boot media so an attacker cannot substitute a crafted EFI PE binary (trade-off: complicates field servicing). Enabling verified/secure boot to reject unsigned EFI images also reduces exposure by ensuring only trusted binaries reach the loader. The maintainer explicitly notes barebox networking is intended as a development feature and should not be used in production, which itself is a meaningful control for exposed fleets.
common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash
crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest v
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length fiel
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length f
Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a field of an in
A signature bypass vulnerability exists in the barebox bootloader's FIT (Flattened Image Tree) image verification mechan
Denial of service in the barebox bootloader (all versions up to and including 2026.04.0) lets an attacker on the same br
Infinite loop denial-of-service in barebox's ext4 directory parser allows an attacker who can supply a crafted filesyste
Out-of-bounds read vulnerabilities in barebox's ext4 extent parsing allow an attacker who can supply a malformed ext4 fi
Same weakness CWE-190 – Integer Overflow or Wraparound
View allShare
External POC / Exploit Code
Leaving vuln.today