PT-2026-29250 · Rauc · Rauc

Yosuke-Tanimoto · Publicado 2026-03-31 · Atualizado 2026-04-02 · CVE-2026-34155

Positive Technologies (AI Summary)

CVSS v4.0

7.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions RAUC versions prior to 1.15.2

Description RAUC manages the update process on embedded Linux systems. When using the 'plain' format, bundles larger than 2 GiB can cause an integer overflow, leading to a signature that only covers a portion of the payload. An attacker could exploit this by modifying the unsigned part of a legitimately signed bundle.

Recommendations Update to version 1.15.2 or later.

Exploit

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

CWE-196

Identificadores relacionados

CVE-2026-34155

GHSA-6HJ7-Q844-M2HX

Produtos afetados

Rauc

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34155.json · Exploit
• https://github.com/rauc/rauc/commit/4fb7c798d6ae412344fb8f8d310d773046af3441 · Correção
• https://github.com/rauc/rauc/releases/tag/v1.15.2 · Nota
• https://github.com/rauc/rauc/security/advisories/GHSA-6hj7-q844-m2hx · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-34155 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2026-34155 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34155 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2039004461113200889 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34155 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-34155 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-34155 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-34155 · Aviso do Fabricante