CVE-2026-34963

HighPublic PoC

Published: 11 May 2026

Published

11 May 2026

Modified

13 May 2026

KEV Added

—

Patch

—

CVSS Score v4 8.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0016 5.3th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-34963 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Pengutronix Barebox. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique TFTP Boot (T1542.005); ranked at the 5.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-29347

Vulnerability details

barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section…

loading logic fails to validate that PointerToRawData plus copied size remains within the PE file buffer. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot to trigger heap buffer overflow or out-of-bounds read from heap memory, potentially achieving code execution in bootloader context.

CWE(s): CWE-190

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1542.005 TFTP Boot Stealth

Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server.

attack.mitre.org →

T1091 Replication Through Removable Media Lateral Movement

Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.

attack.mitre.org →

Why these techniques?

Vulnerability in barebox EFI PE loader enables code execution via malicious binaries supplied over TFTP/network boot (T1542.005) or removable media (T1091).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0