EUVD-2026-29290
GHSA-fqhc-8hwj-969h
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcp_message_type() function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet without a proper 0xff end marker to cause the parser to read past valid packet data and potentially crash the system.
AnalysisAI
Denial of service in the barebox bootloader (all versions up to and including 2026.04.0) lets an attacker on the same broadcast domain crash the device by sending a crafted DHCP Offer or ACK packet that omits the 0xff end marker, triggering an out-of-bounds read in the dhcp_message_type() option parser. Exploitation is unauthenticated but requires adjacent network access, and impact is limited to availability (a crash) rather than code execution or data theft. No public exploit is identified at time of analysis and the EPSS probability is negligible (0.01%, 1st percentile).
common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash
crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest v
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length fiel
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length f
Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a field of an in
Memory corruption in the barebox bootloader's EFI PE loader (efi/loader/pe.c) affects all versions prior to 2026.04.0, a
A signature bypass vulnerability exists in the barebox bootloader's FIT (Flattened Image Tree) image verification mechan
Infinite loop denial-of-service in barebox's ext4 directory parser allows an attacker who can supply a crafted filesyste
Out-of-bounds read vulnerabilities in barebox's ext4 extent parsing allow an attacker who can supply a malformed ext4 fi
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today