Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: barebox 2026.04.0 Clear all filters
TI-2026-27185 CVE-2026-34963 · GHSA-qj4w-p892-c352

barebox EFI PE Loader Memory Safety Vulnerabilities

Priority LOW 38

barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section Virtu…

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.00155 Published 2026-05-11 Fixed in 2026.04.0 CWE-190
TI-2026-27184 CVE-2026-34962 · GHSA-gh28-ww79-7h4v

barebox ext4 Directory Parsing Infinite Loop Denial of Service

Priority LOW 29

barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir() function fails to validate that directory entry length value…

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00129 Published 2026-05-11 Fixed CWE-835
TI-2026-27183 CVE-2026-34961 · GHSA-vv9w-vff6-5rx9

barebox ext4 Extent Parsing Out-of-Bounds Read

Priority LOW 30

barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00207 Published 2026-05-11 Fixed CWE-125
TI-2026-27182 CVE-2026-34960 · GHSA-fqhc-8hwj-969h

barebox Out-of-Bounds Read in DHCP Option Parsing

Priority LOW 31

barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcp_message_type() function that fails to verify the options pointer remains within received packet bound…

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.0025 Published 2026-05-11 Fixed CWE-125