Description
A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node-s Length field is at least 4 bytes, which is the minimum size for an EFI (Extensible Firmware Interface) device path node header. A local user could exploit this vulnerability by providing a specially crafted device path node. This can lead to infinite recursion, causing stack exhaustion and a process crash, resulting in a denial of service (DoS).
CVSS 5.5EPSS 0.104%Risk 0.56
View source- Published
- 2026-04-22 14:17:08
- Affected versions
- unknown
- Type
- Firmware
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H