EUVD-2026-29290
GHSA-fqhc-8hwj-969h
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Denial of service in the barebox bootloader (all versions up to and including 2026.04.0) lets an attacker on the same broadcast domain crash the device by sending a crafted DHCP Offer or ACK packet that omits the 0xff end marker, triggering an out-of-bounds read in the dhcp_message_type() option parser. Exploitation is unauthenticated but requires adjacent network access, and impact is limited to availability (a crash) rather than code execution or data theft. No public exploit is identified at time of analysis and the EPSS probability is negligible (0.01%, 1st percentile).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Barebox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcp_message_type() function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet without a proper 0xff end marker to cause the parser to read past valid packet data and potentially crash the system.
Executive ViewAI
CVE-2026-34960 creates a denial-of-service risk for organizations operating barebox bootloader-based devices (versions through 2026.04.0) connected to broadcast networks. While exploitation probability is negligible (EPSS 0.01%), network-adjacent attackers could crash affected devices, disrupting availability of IoT and embedded systems until patches are applied.
Within 24 hours, inventory all systems running barebox bootloader versions up to 2026.04.0, classify by criticality, and implement network isolation controls to restrict broadcast-domain access where possible. Within 7 days, initiate staged deployment of the vendor-released patch starting with critical infrastructure devices according to standard change management procedures. Within 30 days, complete patching across all affected barebox deployments and validate that compensating network segmentation controls remain effective.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash
crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest v
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length fiel
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length f
Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a field of an in
Memory corruption in the barebox bootloader's EFI PE loader (efi/loader/pe.c) affects all versions prior to 2026.04.0, a
A signature bypass vulnerability exists in the barebox bootloader's FIT (Flattened Image Tree) image verification mechan
Infinite loop denial-of-service in barebox's ext4 directory parser allows an attacker who can supply a crafted filesyste
Out-of-bounds read vulnerabilities in barebox's ext4 extent parsing allow an attacker who can supply a malformed ext4 fi
Exploit-DB