Intel Slim Bootloader: Denial of service in Ext2 parser
Summary
Intel Slim Bootloader, an open-source reference bootloader that runs before the operating system, contains an incorrect comparison in its Ext2 filesystem parser. A local attacker with privileged access on the host can trigger a denial of service and possibly data corruption. The attack requires attack requirements to be present and no user interaction; confidentiality of the vulnerable system is not affected.
Affected
Intel Slim Bootloader. Exact affected versions: Unknown. The CNA record only refers to the Intel advisory INTEL-SA-01526, which could not be fully retrieved.
Fixed in
Unknown. Intel advisory INTEL-SA-01526 states that firmware updates are being released to mitigate the vulnerabilities in the advisory. No fixed version for CVE-2026-44624 has been confirmed.
Workaround
- No confirmed workaround.
- Limit privileged local access to affected systems (general advice).
Exploitation
- No evidence of exploitation in the wild found.
- Not listed in CISA KEV.
- No public proof of concept found.
Our recommendation
- Check whether any systems run Slim Bootloader-based firmware. Most typical office endpoints probably do not.
- Monitor INTEL-SA-01526 and the vendor's firmware updates, and apply them once a fix for this CVE is confirmed.
- Prioritise the other CVEs in the same advisory that are rated higher, such as CVE-2026-41221 and CVE-2026-41224 (8.6).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Security Advisory INTEL-SA-01526 intel.com
- Strix: CVE-2026-44624 www.strix.ai
- OffSeq Radar: CVE-2026-44624 radar.offseq.com
- SecMate: Slim Bootloader Ext2 group descriptor overflow (related Ext2 issue) blog.secmate.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:47.
Original description (NVD)
Incorrect comparison in the Ext2 parser for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.