A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI (Extensible Firmware Interface) device path node header. A local user could exploit this vulnerability by providing a specially crafted device path node. This can lead to infinite recursion, causing stack exhaustion and a process crash, resulting in a denial of service (DoS).
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-6862 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2459982 | Issue Tracking Third Party Advisory |
Configurations
History
13 May 2026, 16:36
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Ubuntu libefiboot
Ubuntu |
|
| References | () https://access.redhat.com/security/cve/CVE-2026-6862 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2459982 - Issue Tracking, Third Party Advisory | |
| CPE | cpe:2.3:a:ubuntu:libefiboot:-:*:*:*:*:*:*:* |
22 Apr 2026, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-22 14:17
Updated : 2026-05-13 16:36
NVD link : CVE-2026-6862
Mitre link : CVE-2026-6862
CVE.ORG link : CVE-2026-6862
JSON object : View
Products Affected
ubuntu
- libefiboot
CWE
CWE-674
Uncontrolled Recursion