PT-2026-26702 · Barebox · Barebox

Published 2026-03-20 · Updated 2026-03-20 · CVE-2026-33243

NVD

CVSS v3.1

8.2

High

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2025.09.3 and from version 2025.10.0 to before version 2026.03.1, when creating a FIT, mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and can therefore be modified by an attacker to trick the bootloader into booting different images than those that have been verified. This issue has been patched in barebox versions 2025.09.3 and 2026.03.1.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-33243

Affected Products

Barebox

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-33243 · Security Note
• https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4 · Note
• https://github.com/barebox/barebox/commit/aca01795056d51060cb096f9a1ea309361743e05 · Note