CVE-2026-34960
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In barebox prior to version 2026.04.0, an out-of-bounds read vulnerability exists in the DHCP option parsing within the dhcp_message_type() function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet without a proper 0xff end marker to cause the parser to read past valid packet data and potentially crash the system.
Risk Assessment
An attacker on the local network can crash the system by sending a specially crafted DHCP packet, leading to device downtime and potential loss of service availability.
Recommendation
Immediately update barebox to version 2026.04.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcp_message_type() function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet without a proper 0xff end marker to cause the parser to read past valid packet data and potentially crash the system.