A flaw in libefiboot, a component of efivar, occurs when the device path node parser fails to ensure that each node’s Length field is at least 4 bytes, the minimum size for an EFI device path node header. This defect allows a specially crafted device path node to trigger infinite recursion, exhausting the stack and crashing the process. The resultant denial of service can cripple applications that depend on efivar and may impact system stability if the crashed process is critical.

The vulnerability affects multiple Red Hat products, including Red Hat Enterprise Linux 10, 7, 8, 9 and Red Hat OpenShift Container Platform 4.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a local user able to supply a crafted device path node, so the attack vector is inferred to be local. No remote or privilege‑escalation vector is documented. Given the moderate score and local nature, the risk is present but limited to systems that run vulnerable versions of libefiboot and accept handcrafted device paths.