Out-of-Bounds Read Vulnerability in Barebox DHCP Parsing

CVE-2026-34960

What is CVE-2026-34960?

The Barebox software prior to version 2026.04.0 is vulnerable to an out-of-bounds read in the DHCP option parsing process. Within the dhcp_message_type() function, the vulnerability arises from insufficient validation of the options pointer, allowing an attacker on the same broadcast domain to send a maliciously crafted DHCP Offer or ACK packet. This packet lacks a proper 0xff end marker, leading the parser to read data beyond the bounds of the received packet, which could result in unpredictable behavior, including potential system crashes.

References