---
id: "CVE-2026-41224"
page: "https://infrastack.ai/live/CVE-2026-41224"
kind: "vulnerability"
aliases: ["CVE-2026-41224"]
title: "Intel Slim Bootloader UEFI firmware: out-of-bounds write allows privilege escalation"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Intel Slim Bootloader", "fixed": ["commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (2026-07-07) or later"], "affected": "builds before commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (2026-07-07)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["firmware", "infrastructure", "intel", "physical-access", "slim-bootloader", "uefi"]
not_affected_if: ["managed-hosting", "no-physical-access", "no-slim-bootloader", "not-using-slim-bootloader"]
published_at: "2026-11-10T18:17:39+00:00"
first_seen_at: "2026-11-10T18:22:58+00:00"
updated_at: "2026-11-10T18:28:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41224", "first_seen_at": "2026-11-10T18:22:58+00:00"}, {"source": "analyst", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html", "first_seen_at": "2026-11-10T18:28:12+00:00", "cites": ["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html"]}]
exploit_sources: []
---

# Intel Slim Bootloader UEFI firmware: out-of-bounds write allows privilege escalation

Link for people: https://infrastack.ai/live/CVE-2026-41224 (this .md is for agents)

Out-of-bounds write in the UEFI firmware of Intel Slim Bootloader may allow privilege escalation via physical access (CVSS 4.0 8.6 High, AV:P, no privileges, no user interaction). Found internally by Intel; fixed in the SBL build from commit 9e77d9ab (July 7, 2026) or later. Disclosed in INTEL-SA-01526 together with five other SBL CVEs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Intel Slim Bootloader affected builds before commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (2026-07-07) fixed commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (2026-07-07) or later

## How to check

Check your Slim Bootloader build/commit: if your device runs SBL built from a source older than commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (7 July 2026), it is affected. Also confirm your CPU is on Intel's list (e.g. Alder Lake, Apollo Lake, Elkhart Lake, Tiger Lake, Meteor Lake, Arrow Lake, Panther Lake, Comet Lake, Coffee Lake, Twin Lake, Amston Lake, Bartlett Lake-S, Ice Lake-D, Granite Rapids-D). Ask your device vendor which SBL commit their firmware is built from.

## Fix

Update Intel Slim Bootloader to the build at commit hash 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (July 7th, 2026) or later, per INTEL-SA-01526. Firmware comes from your board/device vendor.

## Timeline

- 2026-11-10T18:22:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-41224
- 2026-11-10T18:28:12+00:00 analyst https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html — Intel INTEL-SA-01526 (11/10/2026) read in full; CVE-2026-41224 listed, fix = SBL hash 9e77d9ab... from 2026-07-07 or later. No exploitation or PoC mentioned; found internally by Intel.

## Documents

- [advisory] INTEL-SA-01526 Intel Slim Bootloader Advisory https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html

## From the sources

Out-of-bounds write in the UEFI firmware for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalation of privilege. Startup code and smm adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_