Rauc CVE-2026-34155

RAUC versions before 1.15.2 using 'plain' bundle format with payload exceeding 2 GiB. Requires legitimate signed bundle and attacker ability to modify payload post-signature. Victim must apply the malicious bundle update.

Although CVSS data is unavailable, this vulnerability carries significant real-world risk for embedded systems operators. The attack requires pre-existing bundle access and modification capability, suggesting a post-delivery or supply-chain attack vector rather than remote network exploitation. The attack complexity is moderate-an attacker must understand the integer overflow mechanics and have the original legitimately-signed bundle. The technical impact is severe: an attacker can inject malicious firmware or payload modifications that bypass signature verification, potentially compromising embedded device security. The absence of public exploit code or CISA KEV confirmation suggests either recent discovery or limited public awareness, but the straightforward nature of the exploit (modifying unverified payload portions) means weaponization risk is moderate-to-high. For critical embedded systems deployments (IoT, automotive, industrial), this represents a high-priority patching requirement despite the constrained attack vector. Organizations using RAUC for firmware distribution should prioritize immediate assessment of bundle sizes and apply the patched version.

An attacker with access to a legitimate RAUC bundle (via supply-chain compromise, network interception, or insider access) recognizes that the 'plain' format payload exceeds 2 GiB and exploits the integer overflow to calculate which portions of the payload are not covered by the existing valid signature. The attacker then modifies those unverified portions-for example, injecting malicious code into a firmware update-and redistributes the modified bundle. When a RAUC-managed embedded device receives and verifies the bundle, the signature validation passes because the overflow ensures the signature only covers the small initial portion of the payload, and the malicious modifications are never checked.