CVE-2026-34961
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability in barebox prior to version 2026.04.0 allows out-of-bounds reads during ext4 filesystem parsing. Missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c enables attackers to supply a malicious ext4 image via USB, SD card, or network boot.
Risk Assessment
An attacker can exploit this to read heap memory beyond allocated buffers, potentially leaking sensitive information or redirecting reads to arbitrary disk offsets during boot-time filesystem parsing.
Recommendation
Upgrade barebox to version 2026.04.0 or later, which includes fixes for field validation in the ext4 parser.
Original NVD description (English source)
barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c. Attackers can supply a malicious ext4 filesystem image via USB, SD card, or network boot to trigger heap out-of-bounds reads during boot-time filesystem parsing, potentially redirecting reads to arbitrary disk offsets.