PT-2026-39849 · Barebox · Barebox

Kazuma Matsumoto · Published 2026-05-11 · Updated 2026-05-16 · CVE-2026-34960

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions barebox versions prior to 2026.04.0

Description An out-of-bounds read occurs during DHCP option parsing within the dhcp message type() function because the software fails to verify that the options pointer remains within the received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet lacking a proper 0xff end marker, causing the parser to read past valid packet data and potentially crash the system.

Recommendations Update to version 2026.04.0 or later. As a temporary workaround, restrict access to the network broadcast domain to minimize the risk of receiving crafted DHCP packets.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-34960

Affected Products

Barebox

References · 7

• https://github.com/barebox/barebox/releases/tag/v2026.04.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34960 · Security Note
• https://github.com/barebox/barebox · Note
• https://t.me/cveNotify/163729 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2054051303387455925 · Twitter Post
• https://vulncheck.com/advisories/barebox-out-of-bounds-read-in-dhcp-option-parsing · Note
• https://t.me/cveNotify/163134 · Telegram Post