{"id":"CVE-2026-41224","kind":"vulnerability","aliases":["CVE-2026-41224"],"related":[],"title":"Intel Slim Bootloader UEFI firmware: out-of-bounds write allows privilege escalation","description":"Out-of-bounds write in the UEFI firmware for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalation of privilege. Startup code and smm adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.","summary":"Out-of-bounds write in the UEFI firmware of Intel Slim Bootloader may allow privilege escalation via physical access (CVSS 4.0 8.6 High, AV:P, no privileges, no user interaction). Found internally by Intel; fixed in the SBL build from commit 9e77d9ab (July 7, 2026) or later. Disclosed in INTEL-SA-01526 together with five other SBL CVEs.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Intel Slim Bootloader","fixed":["commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (2026-07-07) or later"],"affected":"builds before commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (2026-07-07)","ecosystem":"vendor"}],"ecosystems":[],"tags":["firmware","infrastructure","intel","physical-access","slim-bootloader","uefi"],"not_affected_if":["managed-hosting","no-physical-access","no-slim-bootloader","not-using-slim-bootloader"],"how_to_check":"Check your Slim Bootloader build/commit: if your device runs SBL built from a source older than commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (7 July 2026), it is affected. Also confirm your CPU is on Intel's list (e.g. Alder Lake, Apollo Lake, Elkhart Lake, Tiger Lake, Meteor Lake, Arrow Lake, Panther Lake, Comet Lake, Coffee Lake, Twin Lake, Amston Lake, Bartlett Lake-S, Ice Lake-D, Granite Rapids-D). Ask your device vendor which SBL commit their firmware is built from.","fix":"Update Intel Slim Bootloader to the build at commit hash 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (July 7th, 2026) or later, per INTEL-SA-01526. Firmware comes from your board/device vendor.","status":"open","published_at":"2026-11-10T18:17:39+00:00","first_seen_at":"2026-11-10T18:22:58+00:00","triaged_at":"2026-11-10T18:24:23+00:00","updated_at":"2026-11-10T18:28:12+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T18:24:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel Slim Bootloader UEFI firmware: out-of-bounds write allows privilege escalation","impact":"high","summary":"An out-of-bounds write in the UEFI firmware of Intel's Slim Bootloader lets a local attacker with physical access escalate privileges to Ring 0. Per the NVD description, an attacker could gain full confidentiality, integrity and availability impact on the affected system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel","slim-bootloader","uefi","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker gains Ring 0 privileges and full system compromise","analyst_note":"Find the Intel security advisory and affected firmware versions for Slim Bootloader; the NVD entry alone names no versions or fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-slim-bootloader","managed-hosting"],"who_is_affected":"Systems that run Intel Slim Bootloader UEFI firmware are the ones exposed; the sources do not name affected versions or platforms. The attack is described as requiring physical access and no user interaction, so machines in controlled locations carry lower practical risk. Teams that do not run Slim Bootloader can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000729,"input_tokens":4682,"output_tokens":522,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Intel security advisory and affected firmware versions for Slim Bootloader; the NVD entry alone names no versions or fix.","search":"'-2026':15A,18A '-41224':16A,19A '0':111C '01526':87B '2026':79B '4.0':54B '7':78B '8.6':55B '9e77':75B 'access':28B,52B,148C 'adversari':125C 'allow':11A,47B,116C 'attack':135C,150C 'av':57B 'avail':175C,190C 'bare':112C 'bootload':3A,31B,45B,108C 'bootloader':22A 'bound':9A,36B,97C 'build':72B 'code':122C 'combin':130C 'commit':74B 'complex':134C 'confidenti':170C,185C 'cve':14A,17A 'cves':93B 'cvss':53B 'd9ab':76B 'disclos':82B 'enabl':137C 'escal':13A,49B,118C,138C 'firmwar':5A,23B,41B,102C 'five':90B 'fix':68B 'found':64B 'high':56B,171C,173C,176C,186C,188C,191C 'impact':168C,192C 'infrastructur':24B 'integr':172C,187C 'intel':1A,20A,25B,43B,67B,85B,105C 'intel-sa':84B 'interact':63B,163C 'intern':65B,157C 'juli':77B 'knowledg':158C 'later':81B 'low':133C 'may':46B,115C,136C,143C,167C 'metal':113C 'occur':145C 'os':114C 'out-of-bound':6A,33B,94C 'p':58B 'physic':27B,51B,147C 'physical-access':26B 'potenti':144C,165C 'present':154C 'privileg':12A,48B,60B,120C,140C 'r':106C 'requir':151C,160C 'result':142C,181C 'ring':110C 'sa':86B 'sbl':71B,92B 'slim':2A,21A,30B,44B,107C 'slim-bootload':29B 'smm':124C 'special':156C 'startup':121C 'subsequ':183C 'system':180C,184C 'togeth':88B 'uefi':4A,32B,40B,101C 'unauthent':128C 'user':62B,129C,162C 'via':50B,146C 'vulner':166C,179C 'within':109C 'without':155C 'write':10A,37B,98C","nicknames":[],"mitigations":[],"who_affected":"Devices that boot with Intel Slim Bootloader on the listed Intel CPUs (embedded, edge, IoT, some mobile/desktop platforms such as Alder Lake, Apollo Lake, Elkhart Lake, Tiger Lake). The attack needs physical access, so risk is mainly for unattended or field-deployed hardware. Systems not using Slim Bootloader (standard BIOS/UEFI from other vendors) can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T18:28:12Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html","run_id":2499},"products":{"at":"2026-11-10T18:28:12Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html","run_id":2499},"how_to_check":{"at":"2026-11-10T18:28:12Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html","run_id":2499},"who_affected":{"at":"2026-11-10T18:28:12Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html","run_id":2499}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["intelslimbootloader","slimbootloader"],"ptokens":["bootloader","intel","slim"],"labels":["firmware","high","infrastructure","intel","physicalaccess","slimbootloader","uefi"],"campaign_type":null,"search_a":"'-2026':15A,18A '-41224':16A,19A 'allow':11A 'bootload':3A 'bootloader':22A 'bound':9A 'cve':14A,17A 'escal':13A 'firmwar':5A 'intel':1A,20A 'out-of-bound':6A 'privileg':12A 'slim':2A,21A 'uefi':4A 'write':10A","search_b":"'01526':87B '2026':79B '4.0':54B '7':78B '8.6':55B '9e77':75B 'access':28B,52B 'allow':47B 'av':57B 'bootload':31B,45B 'bound':36B 'build':72B 'commit':74B 'cves':93B 'cvss':53B 'd9ab':76B 'disclos':82B 'escal':49B 'firmwar':23B,41B 'five':90B 'fix':68B 'found':64B 'high':56B 'infrastructur':24B 'intel':25B,43B,67B,85B 'intel-sa':84B 'interact':63B 'intern':65B 'juli':77B 'later':81B 'may':46B 'out-of-bound':33B 'p':58B 'physic':27B,51B 'physical-access':26B 'privileg':48B,60B 'sa':86B 'sbl':71B,92B 'slim':30B,44B 'slim-bootload':29B 'togeth':88B 'uefi':32B,40B 'user':62B 'via':50B 'write':37B","search_c":"'0':111C 'access':148C 'adversari':125C 'allow':116C 'attack':135C,150C 'avail':175C,190C 'bare':112C 'bootload':108C 'bound':97C 'code':122C 'combin':130C 'complex':134C 'confidenti':170C,185C 'enabl':137C 'escal':118C,138C 'firmwar':102C 'high':171C,173C,176C,186C,188C,191C 'impact':168C,192C 'integr':172C,187C 'intel':105C 'interact':163C 'intern':157C 'knowledg':158C 'low':133C 'may':115C,136C,143C,167C 'metal':113C 'occur':145C 'os':114C 'out-of-bound':94C 'physic':147C 'potenti':144C,165C 'present':154C 'privileg':120C,140C 'r':106C 'requir':151C,160C 'result':142C,181C 'ring':110C 'slim':107C 'smm':124C 'special':156C 'startup':121C 'subsequ':183C 'system':180C,184C 'uefi':101C 'unauthent':128C 'user':129C,162C 'via':146C 'vulner':166C,179C 'within':109C 'without':155C 'write':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-41224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41224","severity":null,"published_at":"2026-11-10T18:17:39+00:00","modified_at":"2026-11-10T18:17:39+00:00","first_seen_at":"2026-11-10T18:22:58+00:00","fetched_at":"2026-11-10T18:22:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-41224:2499","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html","severity":null,"published_at":"2026-11-10T18:28:12+00:00","modified_at":"2026-11-10T18:28:12+00:00","first_seen_at":"2026-11-10T18:28:12+00:00","fetched_at":"2026-11-10T18:28:12+00:00","note":"Intel INTEL-SA-01526 (11/10/2026) read in full; CVE-2026-41224 listed, fix = SBL hash 9e77d9ab... from 2026-07-07 or later. No exploitation or PoC mentioned; found internally by Intel.","cites":["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html"]}],"documents":[{"id":117070,"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html","title":"INTEL-SA-01526 Intel Slim Bootloader Advisory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}