PT-2026-29250 · Rauc · Rauc

Yosuke-Tanimoto · Published 2026-03-31 · Updated 2026-04-02 · CVE-2026-34155

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions RAUC versions prior to 1.15.2

Description RAUC manages the update process on embedded Linux systems. When using the 'plain' format, bundles larger than 2 GiB can cause an integer overflow, leading to a signature that only covers a portion of the payload. An attacker could exploit this by modifying the unsigned part of a legitimately signed bundle.

Recommendations Update to version 1.15.2 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

CWE-196

Related Identifiers

CVE-2026-34155

GHSA-6HJ7-Q844-M2HX

Affected Products

Rauc

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34155.json · Exploit
• https://github.com/rauc/rauc/commit/4fb7c798d6ae412344fb8f8d310d773046af3441 · Patch
• https://github.com/rauc/rauc/security/advisories/GHSA-6hj7-q844-m2hx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34155 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-34155 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34155 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34155 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34155 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34155 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34155 · Vendor Advisory
• https://github.com/rauc/rauc/releases/tag/v1.15.2 · Note
• https://twitter.com/CVEnew/status/2039004461113200889 · Twitter Post