CVE-2026-6862

A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI (Extensible Firmware Interface) device path node header. A local user could exploit this vulnerability by providing a specially crafted device path node. This can lead to infinite recursion, causing stack exhaustion and a process crash, resulting in a denial of service (DoS).

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:69321
https://access.redhat.com/security/cve/CVE-2026-6862	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2459982	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ubuntu:libefiboot:-:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Se encontró un defecto en libefiboot, un componente de efivar. El analizador de nodos de ruta de dispositivo en libefiboot no valida que el campo Longitud de cada nodo sea de al menos 4 bytes, que es el tamaño mínimo para una cabecera de nodo de ruta de dispositivo EFI (Interfaz de Firmware Extensible). Un usuario local podría explotar esta vulnerabilidad al proporcionar un nodo de ruta de dispositivo especialmente diseñado. Esto puede conducir a una recursión infinita, causando el agotamiento de la pila y la caída de un proceso, lo que resulta en una denegación de servicio (DoS).

21 Sep 2026, 18:17

Type	Values Removed	Values Added
References		() https://access.redhat.com/errata/RHSA-2026:69321 -

Information

Published : 2026-04-22 14:17

Updated : 2026-10-26 21:10

NVD link : CVE-2026-6862

Mitre link : CVE-2026-6862

CVE.ORG link : CVE-2026-6862

JSON object : View

Products Affected

ubuntu

libefiboot

CWE

CWE-674

Uncontrolled Recursion

{"id": "CVE-2026-6862", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6862", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T14:28:03.007164Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "39-13.1.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "efivar-main", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "efivar", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "efivar", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "efivar", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "efivar", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}]}], "published": "2026-04-22T14:17:08.060", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:69321", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-6862", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459982", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI (Extensible Firmware Interface) device path node header. A local user could exploit this vulnerability by providing a specially crafted device path node. This can lead to infinite recursion, causing stack exhaustion and a process crash, resulting in a denial of service (DoS)."}, {"lang": "es", "value": "Se encontr\u00f3 un defecto en libefiboot, un componente de efivar. El analizador de nodos de ruta de dispositivo en libefiboot no valida que el campo Longitud de cada nodo sea de al menos 4 bytes, que es el tama\u00f1o m\u00ednimo para una cabecera de nodo de ruta de dispositivo EFI (Interfaz de Firmware Extensible). Un usuario local podr\u00eda explotar esta vulnerabilidad al proporcionar un nodo de ruta de dispositivo especialmente dise\u00f1ado. Esto puede conducir a una recursi\u00f3n infinita, causando el agotamiento de la pila y la ca\u00edda de un proceso, lo que resulta en una denegaci\u00f3n de servicio (DoS)."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ubuntu:libefiboot:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6329FD90-441C-40D7-A882-78B263717A16"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}