CVE-2026-34961
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability in barebox prior to version 2026.04.0 allows out-of-bounds reads during ext4 filesystem parsing. Missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c enables attackers to supply a malicious ext4 image via USB, SD card, or network boot.
Risk Assessment
An attacker can exploit this to read heap memory beyond allocated buffers, potentially leaking sensitive information or redirecting reads to arbitrary disk offsets during boot-time filesystem parsing.
Recommendation
Upgrade barebox to version 2026.04.0 or later, which includes fixes for field validation in the ext4 parser.
Other vulnerabilities in barebox
See all- CVE-2026-34963High
In barebox bootloader prior to version 2026.04.0, multiple memory-safety vulnerabilities exist in the EFI PE loader (efi/loader/pe.c). Integer overflow in virtual image size calculation and missing validation of PointerToRawData lead to undersized heap allocation and out-of-bounds heap read. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot, potentially causing heap buffer overflow and code execution in bootloader context.
- CVE-2026-34962Medium
A denial-of-service vulnerability in barebox prior to version 2026.04.0 allows attackers to cause an infinite loop during directory listing or path resolution by supplying a malicious ext4 filesystem image with a crafted directory entry containing a zero-length value.
- CVE-2026-34960Medium
In barebox prior to version 2026.04.0, an out-of-bounds read vulnerability exists in the DHCP option parsing within the dhcp_message_type() function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet without a proper 0xff end marker to cause the parser to read past valid packet data and potentially crash the system.
Original NVD description (English source)
barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c. Attackers can supply a malicious ext4 filesystem image via USB, SD card, or network boot to trigger heap out-of-bounds reads during boot-time filesystem parsing, potentially redirecting reads to arbitrary disk offsets.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS