CVE-2026-34960 Details
Description
barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcp_message_type() function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet without a proper 0xff end marker to cause the parser to read past valid packet data and potentially crash the system.
A out-of-bounds read vulnerability has been identified in barebox versions prior to 2026.04.0. The issue arises in the DHCP option parsing within the dhcp_message_type() function, where the parser fails to properly validate the options pointer against the bounds of the received packet. This vulnerability allows an attacker on the same broadcast domain to send a crafted DHCP Offer or ACK packet that lacks a proper 0xff end marker. As a result, the parser can read beyond the valid packet data, potentially leading to a system crash.
Users can upgrade to barebox version 2026.04.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pengutronix barebox | < 2026.04.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 18, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 16, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | New CVE Received | [email protected] |