Threat database

barebox versions prior to 2026.04.0 contain multiple memory-safety vulnerabilities in the EFI PE loader component. These include an integer overflow during virtual image size calculation and improper validation of PE section data boundaries. Exploitation can occur by supplying a malicious EFI PE binary via TFTP, USB, SD card, or network boot, potentially leading to heap buffer overflow or out-of-bounds reads. This may allow code execution within the bootloader context.

barebox versions prior to 2026.04.0 contain out-of-bounds read vulnerabilities in the ext4 filesystem extent parsing code. The issue arises from missing validation of the eh_entries field against buffer capacity, which can lead to heap out-of-bounds reads during boot-time filesystem parsing. An attacker can exploit this by supplying a malicious ext4 filesystem image via USB, SD card, or network boot. This vulnerability has been assigned CVE-2026-34961 and is rated medium severity. A patch is available in version 2026.04.0.

A denial-of-service vulnerability exists in barebox versions prior to 2026.04.0 due to improper validation of directory entry lengths in ext4 filesystem parsing. Specifically, the ext4fs_iterate_dir() function does not check that directory entry length values are non-zero, allowing crafted ext4 filesystem images with zero-length directory entries to cause an infinite loop. This results in the boot process hanging indefinitely.

barebox versions prior to 2026.04.0 have an out-of-bounds read vulnerability in the DHCP option parsing code. The vulnerability occurs in the dhcp_message_type() function, which does not properly verify that the options pointer stays within the bounds of the received DHCP packet. An attacker on the same broadcast domain can exploit this by sending a crafted DHCP Offer or ACK packet missing the required 0xff end marker, causing the parser to read beyond valid data and potentially crash the system.