CVE-2026-79298

CVE-2026-79298 is a local arbitrary code execution vulnerability in Howyar Technologies' SysReturn system recovery software, affecting versions prior to 11.3.0.34. The flaw lies in the UEFI boot component BOOTia32.efi, which a local attacker can abuse by placing a crafted cloak32.dat file on the EFI System Partition (ESP); on the next boot, the loader processes this file and executes attacker-controlled code. Because execution occurs through the EFI boot component, an attacker who already has local access (physical or via malware with sufficient disk access) can gain code execution in the pre-boot environment, a strong position for privilege escalation and stealthy, persistent compromise. Any machine running an affected SysReturn version, typically PCs and recovery/kiosk deployments bundled with Howyar's restore solution, is affected. There is no evidence of in-the-wild exploitation and the flaw is not in CISA's KEV, but a public proof-of-concept is available on GitHub.

What to do: Upgrade SysReturn to version 11.3.0.34 or later on all managed machines. Restrict write access to the EFI System Partition where possible and audit endpoints for unexpected or modified BOOTia32.efi and cloak32.dat files, since a planted cloak32.dat is the exploit vector. Because exploitation requires local access, maintain endpoint hardening, malware defense, and physical access controls on affected systems.