CVE-2026-28729

Executive Summary

CVE-2026-28729 is an integer overflow vulnerability (CWE-190) in the UEFI firmware of Intel(R) Slim Bootloader (SBL), a lightweight, open-source bootloader used on embedded and IoT platforms. The flaw is triggerable by a locally authenticated system-software adversary via a low-complexity attack that additionally requires active user interaction, and it may lead to information disclosure (low confidentiality impact) and denial of service (low availability impact) with no integrity impact. As of this writing the vulnerability is unpatched — no vendor advisory, fixed version, or workaround exists — and no public exploit code or evidence of in-the-wild exploitation has been observed (CISA KEV: NO; EPSS: 0.00112, at the 1.6th percentile of exploited CVEs).

Technical Analysis

CVE-2026-28729 is an integer overflow (CWE-190) condition that exists in the UEFI firmware component of the Intel Slim Bootloader. In firmware codebases written in C, integer overflows typically occur when an arithmetic operation — commonly addition, multiplication, or an increment/decrement on a size, length, count, or index calculation — produces a result that exceeds the maximum value representable by the underlying integer type. The wrapped result is then used in a subsequent memory-management or data-copy operation. Two impact classes are described in the NVD entry:

• Information disclosure (confidentiality: low): The overflowed value most plausibly corrupts a buffer bound or allocation size, allowing the firmware to copy or read a larger region of memory than intended. The resulting out-of-bounds read can expose contents of firmware-resident memory, including transient boot data or configuration material that would otherwise be inaccessible to the caller.
• Denial of service (availability: low): A corrupted size, length, or index value can cause the bootloader to dereference an invalid memory address or hit an architectural fault within the firmware execution context. Because the flaw is in pre-OS firmware, such a fault can halt the boot process, hang the platform, or force the device into a recovery path, requiring manual intervention or a full reboot.

The attacker preconditions described in the NVD entry are important for scoping the threat: the adversary is a "system software" attacker — meaning a local user or process already holding an authenticated session on the target platform — and the attack requires active user interaction. This indicates the vulnerable code path is not reachable purely by automated means; the authenticated user must be induced to perform an action that causes attacker-influenced data to flow into the overflowed arithmetic operation. Importantly, the description states the attack proceeds "without special internal knowledge," so no deep reverse engineering of the bootloader is required, and "attack requirements are not present" beyond the authenticated local session and interaction. This combination — local access, low complexity, and minimal preconditions — makes the vulnerability mechanically simple to trigger once a user can be socially engineered into the required interaction.

Intel Slim Bootloader is a minimal UEFI firmware optimized for fast boot on embedded, edge, and client platforms. Vulnerabilities at this layer are particularly impactful because they execute before the operating system and its security controls are loaded; the bug cannot be mitigated by OS-level memory protections, and any flaw in firmware arithmetic persists beneath the entire software stack. The attack surface therefore encompasses any platform provisioned with an affected SBL image, with the practical exploitation surface being any locally accessible input or configuration channel that reaches a size/length/count calculation in the bootloader. The NVD description does not disclose the specific function, file, or input vector that hosts the overflow; insufficient technical detail is available to name the vulnerable code path.

Exploitation Scenarios

No public PoC is available for CVE-2026-28729, and no exploit code has been observed in the wild. The attack chain described below is inferred from the vulnerability class (CWE-190 integer overflow) and the conditions explicitly stated in the NVD description. It should be treated as an analytical projection, not a verified exploit procedure.

1. Reconnaissance and target identification. The attacker must already possess an authenticated local session on a device running an affected Intel Slim Bootloader image. Target identification consists of confirming the platform boots via SBL — for example, through local firmware version disclosure during boot, OS-level platform enumeration, or interaction with bootloader management utilities. No network reconnaissance is required, as the attack vector is explicitly local.

2. Triggering the flaw. The NVD description requires active user interaction. The attacker must therefore convince the authenticated user to perform an action that forwards an attacker-influenced numeric value into an SBL code path where that value participates in a size, count, length, or index arithmetic operation. In an integer-overflow vulnerability, the critical input is typically a large integer (or a crafted combination of values) that, when added to another operand, wraps past the maximum representable value and produces a small or incorrect result.

3. Execution at the vulnerability-class level. The wrapped value is consumed by a subsequent firmware memory operation. Depending on how the overflowed value is used, two outcomes are possible per the NVD description: (a) an undersized allocation or corrupted bound leads to an out-of-bounds memory read, the contents of which are disclosed to the attacker (information disclosure); or (b) the corrupted value drives a faulting memory access, crashing or hanging the bootloader (denial of service). Because the overflow happens in firmware, standard OS-level exploit mitigations — ASLR, stack canaries, sandboxing — are not present to contain the consequence.

4. Post-exploitation impact. A successful information-disclosure outcome yields low-impact confidentiality loss: exposure of limited firmware memory contents that may include transient boot state or configuration data. A successful denial-of-service outcome degrades availability, forcing a reboot and potentially requiring a recovery procedure. The NVD explicitly rates the integrity impact as none, meaning the attacker is not expected to be able to modify firmware or persistent data through this flaw. No privilege escalation to firmware-level code execution is described, and no such capability should be inferred from the provided data.

The exploitation scenarios are constrained by two practical gates: the requirement for an authenticated local session and the requirement for active user interaction. These gates substantially reduce the practical exploitability of the flaw in hardened environments, consistent with the low EPSS score (0.00112).

Impact Assessment

The business impact of CVE-2026-28729 is moderate but with a wide potential blast radius in terms of affected platform classes. Intel Slim Bootloader is positioned as a lightweight UEFI implementation for embedded and IoT devices, where firmware is rarely updated and often outlives the OS security patch cycle. Any organization operating SBL-based endpoints, edge gateways, kiosks, or industrial controllers inherits the vulnerability and must treat the firmware layer as an enduring risk until a fix is published.

The NVD impact metrics describe a low confidentiality impact, no integrity impact, and low availability impact. The availability impact (denial of service) is arguably the more operationally relevant outcome: in an IoT or edge deployment, a remotely unassisted attack is not possible, but a malicious insider or a user tricked into the required interaction can repeatedly crash the device during boot, creating an availability risk for business-critical hardware. The information-disclosure component is limited to low confidentiality impact, suggesting the exposed memory region is bounded and does not include high-value secrets such as firmware signing keys.

System exposure is compounded by the fact that this CVE is unpatched (patch confidence 0/4). There is no fixed SBL release, no vendor advisory, and no workaround documented by Intel or any other source. Until a patch is issued, every affected device carries the vulnerability. That said, the practical likelihood of exploitation remains low in the near term: the threat requires local authenticated access plus user interaction, no public PoC exists, there is no CISA KEV inclusion, and the EPSS score sits at the 1.6th percentile of exploited CVEs. The primary defensive problem is therefore not an active campaign — none is known — but the absence of any remediation path for an unpatched firmware flaw.

Detection Guidance

Because CVE-2026-28729 is a local, pre-OS firmware vulnerability, network-based detection is of limited value. The rules below focus on the observable side effects an attacker or malware would produce while interacting with, provisioning, or tampering with Slim Bootloader artifacts: process execution referencing SBL components, file writes to the UEFI system partition, and transfer of SBL firmware images over the network. These detections are heuristic and should be treated as telemetry for firmware supply-chain and deployment hygiene, not as deterministic indicators of exploitation of the overflow itself.

Sigma Rule

title: Intel Slim Bootloader UEFI Artifact or Process Activity
id: 4c2f2a5e-7d1b-4e9a-9f3c-8b6c1d2e4f5a
status: experimental
description: Detects process execution or file activity referencing Intel Slim Bootloader artifacts, potentially indicating interaction with an affected UEFI firmware image.
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    CommandLine|contains:
      - 'SlimBootloader'
      - 'Slim Bootloader'
      - 'slimboot'
      - 'uefi'
  selection_efi:
    Image|endswith:
      - '\flash.exe'
      - '\update.exe'
  condition: selection_process or selection_efi
falsepositives:
  - Legitimate firmware update utilities run by administrators
  - Development work on Slim Bootloader images
level: medium
tags:
  - attack.impact
  - attack.t1499
  - cve.2026-28729

YARA Rule

rule CVE_2026_28729_Slim_Bootloader_Firmware {
    meta:
        author = "Valters IT Security Research"
        description = "Detects firmware images or artifacts containing Intel Slim Bootloader identifiers, potentially associated with CVE-2026-28729 affected platforms."
        cve = "CVE-2026-28729"
        date = "2026-02-01"
    strings:
        $s1 = "Slim Bootloader" ascii nocase
        $s2 = "SlimBootloader" ascii nocase
        $s3 = "SLIM BOOT" ascii nocase
        $s4 = "Intel Slim Bootloader" ascii nocase
    condition:
        2 of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-28729 - Intel Slim Bootloader UEFI artifact transfer over HTTP"; flow:established,to_client; content:"Slim Bootloader"; nocase; http.server_body; classtype:attempted-recon; sid:202628729; rev:1; metadata:created_at 2026_02_01, cve CVE-2026-28729;)

Network detection is inherently limited for this vulnerability given its local-only attack vector; this rule flags in-transit firmware images or documentation referencing SBL during provisioning or exfiltration, which may indicate an attacker staging or harvesting bootloader artifacts.

Elastic Detection

any where
  (process.name like "*sbl*" or
   process.command_line like "*SlimBootloader*" or
   process.command_line like "*Slim Bootloader*")
or
  (file.path like "*\\EFI\\*" and
   (file.name like "*sbl*" or file.name like "*Slim*"))

Splunk SPL Query

index=* (process="*SlimBootloader*" OR CommandLine="*Slim Bootloader*" OR process="*sbl*" OR file_path="*\\EFI\\*") 
| stats count earliest(_time) as first_seen latest(_time) as last_seen by host, user, process, CommandLine, file_path 
| where count > 1 
| sort - last_seen

Wazuh OSSEC Rule

<rule id="100287" level="10">
  <decoded_as>json</decoded_as>
  <field name="win.eventdata.commandLine">(?i).*SlimBootloader.*</field>
  <description>Intel Slim Bootloader (CVE-2026-28729) related process or artifact access detected.</description>
  <group>uefi,firmware,t1499,</group>
</rule>

<rule id="100288" level="8">
  <if_sid>100287</if_sid>
  <field name="win.eventdata.user">(?i).*(admin|administrator).*</field>
  <description>Intel Slim Bootloader activity by an administrative user — verify legitimacy.</description>
  <group>uefi,firmware,</group>
</rule>

Mitigation & Patch Guidance

Patch status: UNPATCHED (patch confidence 0/4). No vendor fix, coordinated advisory, patched version, or workaround has been identified from any tracked source. The following guidance is therefore based on compensating controls.

1. Immediate mitigations (compensating controls):

   • Restrict local console and shell access to the platform to trusted, authenticated administrators only. The attack requires an authenticated local session; reducing the population of authenticated users directly shrinks the attack surface.
   • Enforce a zero-trust stance on unattended or shared devices that boot from Slim Bootloader; do not allow standard users to interact with boot menus, firmware update utilities, or boot-time configuration interfaces, since active user interaction is a requirement for triggering the flaw.
   • Where possible, disable unused bootloader features and interfaces (e.g., network boot paths, serial console, debug interfaces) to eliminate unnecessary channels that could feed attacker-controlled values into vulnerable arithmetic paths.
   • Deploy Secure Boot and, if supported, measured boot with a TPM so that any modification of the SBL firmware image is detectable and any unsigned or tampered image is prevented from loading.

2. Patch/upgrade steps:

   • No patch exists. Monitor Intel's Product Security Center and the NVD entry for CVE-2026-28729 on a weekly basis; apply the vendor fix immediately when it is published.
   • Track the OEM or platform vendor that supplies the Slim Bootloader image for your specific hardware; firmware fixes are commonly distributed through the device vendor rather than Intel directly.
   • Validate any firmware update against the vendor's published checksums and, where available, cryptographic signatures before deployment.

3. Long-term hardening:

   • Implement a firmware asset inventory that records the exact Slim Bootloader version and image hash on every affected device, so that the eventual patch can be applied comprehensively.
   • Treat firmware as part of the software supply chain: enforce signed firmware updates, pin known-good hashes, and perform integrity monitoring of the EFI system partition and firmware update tools.
   • For organizations with access to the SBL source code, perform a focused static-analysis review of all integer arithmetic involving size, length, count, and index values (CWE-190 patterns) as part of proactive firmware assurance.
   • Maintain a security-awareness program for administrators operating these devices, emphasizing the "active user interaction" requirement: users who are asked to perform boot-time actions on SBL devices are the human gate an attacker must cross.

References

• NVD Entry — CVE-2026-28729: https://nvd.nist.gov/vuln/detail/CVE-2026-28729
• MITRE CVE List — CVE-2026-28729: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28729
• CWE-190 (Integer Overflow or Wraparound): https://cwe.mitre.org/data/definitions/190.html
• Intel Product Security Center (no advisory published for this CVE as of this report): https://www.intel.com/content/www/us/en/security-center/default.html
• FIRST EPSS — CVE-2026-28729 scoring context: https://www.first.org/epss/

Threat-actor and in-the-wild evidence: None known. No campaign attribution, exploit-in-the-wild reports, or CISA KEV inclusion exists for CVE-2026-28729 at the time of writing. The vulnerability is unpatched, and the absence of a public PoC or exploitation activity, combined with the low EPSS percentile, suggests that active exploitation is not currently occurring; however, the lack of a patch means the risk window remains open indefinitely.