CVE-2026-34155
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
RAUC versions before 1.15.2 have an integer overflow vulnerability in 'plain' format bundles with payload size exceeding 2 GiB. The signature covers only the first bytes, allowing an attacker to modify the unsigned part.
Risk Assessment
An attacker can modify the unsigned payload part, enabling injection of malicious code or data, compromising update integrity.
Recommendation
Update RAUC to version 1.15.2 or later which contains the fix.
Original NVD description (English source)
RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB cause an integer overflow which results in a signature which covers only the first few bytes of the payload. Given such a bundle with a legitimate signature, an attacker can modify the part of the payload which is not covered by the signature. This issue has been patched in version 1.15.2.