PT-2026-26702 · Barebox · Barebox

Ahmad Fatoum + 1 · Published 2026-03-20 · Updated 2026-05-16 · CVE-2026-33243

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions barebox versions 2016.03.0 through 2025.09.2 barebox versions 2025.10.0 through 2026.03.0

Description barebox is a bootloader. When creating a FIT (Firmware Image Table), the mkimage(1) function sets the hashed-nodes property of the FIT signature node. This property lists the nodes of the FIT that were hashed during the signing process for later verification by the bootloader. However, the hashed-nodes property itself is not included in the hash, allowing an attacker to modify it. This modification can potentially trick the bootloader into booting images that have not been verified.

Recommendations Update to barebox version 2025.09.3 or later. Update to barebox version 2026.03.1 or later.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-33243

GHSA-3FVJ-Q26P-J6H4

OESA-2026-1834

Affected Products

Barebox

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33243.json · Exploit
• https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4 · Vendor Advisory
• https://github.com/barebox/barebox/commit/aca01795056d51060cb096f9a1ea309361743e05 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33243 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33243 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1834 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33243 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33243 · Vendor Advisory
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1834 · Note
• https://twitter.com/CVEnew/status/2035262124524458041 · Twitter Post
• https://twitter.com/TheHackerWire/status/2035133845436342572 · Twitter Post
• https://twitter.com/rhmi_fii/status/2055791796324835835 · Twitter Post