Intel Slim Bootloader: Integer overflow in UEFI firmware allows privilege escalation
Summary
Intel's Slim Bootloader UEFI firmware contains an integer overflow in Ring 0 that can allow an attacker to escalate privileges on the underlying system. According to the advisory, exploitation requires physical access and an attacker with startup code or SMM access, with no privileges or user interaction needed, and a successful attack could affect confidentiality, integrity and availability. The CVE record and the advisory page both list CVSS 8.6 (High), but NVD has not yet analysed the entry.
Affected
- Intel Slim Bootloader (UEFI firmware), per Intel advisory INTEL-SA-01526
- Platforms listed in the advisory include 12th Generation Intel Core processors (Alder Lake), Intel Pentium Gold and Celeron processor families, and Intel Processor N-series (Twin Lake)
- Exact affected firmware versions: Unknown.
Fixed in
Unknown. The advisory states that Intel is releasing firmware updates; no fixed version or commit is listed in the excerpts reviewed.
Workaround
Unknown. No vendor workaround was found.
Exploitation
- No evidence of exploitation in the wild or public proof of concept found as of 10 Nov 2026.
Our recommendation
- Check whether any of your devices run Intel Slim Bootloader or use one of the listed CPU platforms, and ask hardware vendors about their firmware.
- Apply OEM firmware updates as soon as they are published.
- Restrict physical access to servers, shared and unattended systems.
- Monitor intel-sa-01526 and the NVD entry for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Slim Bootloader Advisory INTEL-SA-01526 intel.com
- Intel Slim Bootloader product information firmware.intel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 19:25.
Original description (NVD)
Integer overflow in the UEFI firmware for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalation of privilege. Startup code and smm adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.