# Intel Slim Bootloader Multiple Vulnerabilities (INTEL-SA-01526) - CVE-2026-50175, CVE-2026-35500, CVE-2026-41221, CVE-2026-41224, CVE-2026-44624, CVE-2026-28746

> Intel advisory INTEL-SA-01526 (10 Nov 2026) discloses six vulnerabilities in Intel Slim Bootloader firmware (four High, two Medium, CVSS 4.0 up to 8.6) that could allow escalation of privilege, denial of service or data corruption. Intel recommends updating Slim Bootloader to commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (7 July 2026) or later; no exploitation or public PoC is stated in the sources.

- **Published:** 2026-11-11T07:00:32Z
- **Last reviewed:** 2026-11-11T07:00:32Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5737
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5737.png
- **ID:** TL-2026-5737
- **Severity:** HIGH (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (1 shown free below)
- **CVEs:** CVE-2026-50175, CVE-2026-35500, CVE-2026-41221, CVE-2026-41224, CVE-2026-44624, CVE-2026-28746, CVE-2026-20753

## Description

INTEL-SA-01526 (revision 1.0, released 2026-11-10, category Firmware, severity High) covers six weaknesses in Intel Slim Bootloader (SBL), an open-source boot firmware used on Intel client, embedded and server platforms.

Four issues are rated High under CVSS 4.0. CVE-2026-50175 (8.4) is an untrusted pointer dereference (CWE-822 per NVD) in the FirmwareWakingVector handling; it requires a privileged local system-software adversary, low attack complexity and no user interaction, with high confidentiality/integrity/availability impact on the vulnerable system (reported by vic5589). CVE-2026-35500 (stack-based buffer overflow), CVE-2026-41221 (integer overflow) and CVE-2026-41224 (out-of-bounds write) are all in the UEFI firmware component, each scored 8.6 with vector AV:P/AC:L/PR:N and high impact including subsequent systems; Intel describes an unauthenticated adversary with physical access using startup code or SMM who could escalate privileges. These three were found internally by Intel (credited to Brent Holtsclaw).

Two issues are Medium. CVE-2026-44624 (5.7) is an incorrect comparison in the Ext2 parser (reported by vic5589); the advisory lists impact as denial of service for the header and data corruption for the body, and the advisory's own impact text and summary differ. CVE-2026-28746 (6.7) is an out-of-bounds read in AuthenticateComponent that allows a privileged local adversary to cause denial of service (reported by 0xraban).

Affected platforms are listed by processor family: Alder Lake, Arizona Beach, Amston Lake, Twin Lake, Apollo Lake (Atom E3900), Arrow Lake, Bartlett Lake-S, Raptor Lake, Coffee Lake (Xeon E), Comet Lake, Elkhart Lake, Ice Lake-D, Eddy Lake, Granite Rapids-D, Meteor Lake, Panther Lake and Tiger Lake, with 30 CPUID values; no firmware version numbers are given and the per-CPUID mapping is unclear on the page. The remediation is to update Slim Bootloader to commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (dated 2026-07-07) or later. The advisory provides no CVSS 3.1 scores, no CWE identifiers other than CWE-822 on the NVD record for CVE-2026-50175, and no workarounds. The AUSCERT bulletin ESB-2026.14273 is member-only and redacted. The referenced upstream commit changes the ACPI/FPDT S3-resume code (adds ValidateAcpiPointerInS3 pointer-range checks in AcpiFpdt.c and AcpiInitLib.c); the commit message does not explicitly name the six CVEs, so the mapping of that commit to individual CVEs is not confirmed by the sources. No source states active exploitation, a public PoC, or CISA KEV listing (the CVEs were not found in the portion of the KEV catalog that could be read; the catalog was truncated).

## MITRE ATT&CK

- T1542.001 System Firmware
- T1542.001 System Firmware
- T1565 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5737 Firmware Flash / SPI Write Tool Execution (Slim Bootloader INTEL-SA-01526)** (`TL-2026-5737-SPL-001`)

Detects execution of firmware flashing and SPI/chipset access utilities (flashrom, Intel FPT, AMI AFU, fwupdtool, CHIPSEC) with write-style arguments or Slim Bootloader image references. Intel INTEL-SA-01526 (CVE-2026-50175, CVE-2026-35500, CVE-2026-41221, CVE-2026-41224, CVE-2026-44624, CVE-2026-28746) is a firmware class of flaw with no reported in-the-wild exploitation, so this rule is behaviour-first: it surfaces the tooling an adversary with local privilege would need to read, replace or implant boot firmware (T1542.001) and escalate beyond the OS (T1068).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1542.001, T1068
- **Data sources:** sysmon (index=sysmon, sourcetype XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, EventCode 1), DeviceProcessEvents, windows process_creation
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (Image="*flashrom.exe" OR Image="*fptw64.exe" OR Image="*fptw.exe" OR Image="*afuwinx64.exe" OR Image="*afuwin.exe" OR Image="*fwupdtool.exe" OR Image="*chipsec_main.exe" OR Image="*chipsec_util.exe" OR Image="*spiflash.exe")
| where match(CommandLine, "(?i)( -w | --write| -f |-bios|-rom|-spi|slimbootloader|sbl|ibb|[.]rom|[.]fd|[.]cap)")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images values(User) as users by host Image
| eval first_seen=strftime(first_seen,"%Y-%m-%dT%H:%M:%SZ"), last_seen=strftime(last_seen,"%Y-%m-%dT%H:%M:%SZ"), detection="TL-2026-5737 INTEL-SA-01526 firmware write tool"
| table host users Image parent_images command_lines count first_seen last_seen detection
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('flashrom.exe','fptw64.exe','fptw.exe','afuwinx64.exe','afuwin.exe','fwupdtool.exe','chipsec_main.exe','chipsec_util.exe','spiflash.exe')
| where ProcessCommandLine matches regex @'(?i)( -w | --write| -f |-bios|-rom|-spi|slimbootloader|sbl|ibb|[.]rom|[.]fd|[.]cap)'
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Firmware Flash or SPI Access Utility Execution (TL-2026-5737 Slim Bootloader INTEL-SA-01526)
id: 3f8e2b61-9a4d-4c7e-b1d2-5a60c7e48f13
status: experimental
description: Detects execution of firmware flashing and SPI or chipset access utilities with write style arguments on Windows hosts. Precursor behaviour for Intel Slim Bootloader firmware tampering (CVE-2026-50175, CVE-2026-35500, CVE-2026-41221, CVE-2026-41224). No in the wild exploitation of INTEL-SA-01526 is reported, so this is a hunting and exposure rule.
references:
  - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html
  - https://github.com/slimbootloader/slimbootloader/commit/9e77d9abb867e7ab4fec8249035cf9ba6550aed7
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1542.001
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-50175
  - cve.2026-35500
  - cve.2026-41221
  - cve.2026-41224
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\flashrom.exe'
      - '\fptw64.exe'
      - '\fptw.exe'
      - '\afuwinx64.exe'
      - '\afuwin.exe'
      - '\fwupdtool.exe'
      - '\chipsec_main.exe'
      - '\chipsec_util.exe'
      - '\spiflash.exe'
  selection_args:
    CommandLine|contains:
      - ' -w '
      - '--write'
      - ' -f '
      - '-bios'
      - '-rom'
      - '-spi'
      - 'slimbootloader'
      - '.rom'
      - '.cap'
  condition: selection_img and selection_args
falsepositives:
  - Authorised BIOS or firmware updates run by IT or OEM tooling
  - Firmware engineers and lab systems
level: high

```

**Known false positives:**

- Authorised BIOS/firmware updates run by IT, OEM update agents or imaging pipelines
- Firmware engineering, lab and manufacturing hosts that flash devices daily

**Tuning notes:** Allowlist known firmware engineering hosts and signed OEM update parents (ParentImage). Replace index=sysmon with the index that holds your Sysmon data. Extend the Image list with any vendor flashers in your estate (e.g. OEM-specific flash utilities).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5737 Boot Integrity and Secure Boot Tampering (bcdedit / SecureBoot State) (locked: unlock with TL Creds)
- TL-2026-5737 Firmware / Bootloader Image File Written by Non-Update Process (locked: unlock with TL Creds)
- TL-2026-5737 Remote Execution of Firmware Flash Tools Across Hosts (locked: unlock with TL Creds)
- TL-2026-5737 Linux Firmware Flash / CHIPSEC Tool Execution on Slim Bootloader Platforms (locked: unlock with TL Creds)
- TL-2026-5737 Raw Flash/Memory Device Write or SPI Kernel Module Load on Linux (locked: unlock with TL Creds)
- TL-2026-5737 Ext2 Image Crafting or Editing (SBL Ext2 Parser CVE-2026-44624) (locked: unlock with TL Creds)
- TL-2026-5737 Firmware / Physical-Memory Access Driver Load (SBL SMM & Boot Firmware Precursor) (locked: unlock with TL Creds)
- TL-2026-5737 Repeated S3 Sleep/Resume Faults (FirmwareWakingVector CVE-2026-50175 Impact Signal) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 11)

Defanged, TLP:CLEAR.

- File hash: `9e77d9abb867e7ab4fec8249035cf9ba6550aed7`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Intel Slim Bootloader Advisory INTEL-SA-01526](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html)
- [AUSCERT ESB-2026.14273 - Intel Slim Bootloader (member-only, redacted)](http://portal.auscert.org.au/bulletins/ESB-2026.14273/)
- [NVD - CVE-2026-50175](https://nvd.nist.gov/vuln/detail/CVE-2026-50175)
- [Slim Bootloader fix commit 9e77d9a (FPDT S3 pointer validation)](https://github.com/slimbootloader/slimbootloader/commit/9e77d9abb867e7ab4fec8249035cf9ba6550aed7)
- [Slim Bootloader project repository](https://github.com/slimbootloader/slimbootloader)
- [Intel Slim Bootloader Advisory INTEL-SA-01475 (earlier SBL advisory)](https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01475.html)
- [NVD - CVE-2026-20753 (earlier SBL integer overflow EoP)](https://nvd.nist.gov/vuln/detail/cve-2026-20753)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5737