Out-of-Bounds Read Vulnerability in barebox Affected by Ext4 Filesystem Implementation

CVE-2026-34961

What is CVE-2026-34961?

The barebox bootloader versions before 2026.04.0 are susceptible to out-of-bounds read vulnerabilities related to the ext4 extent parsing functionality. This vulnerability stems from inadequate validation of the 'eh_entries' field against buffer capacity in the code managing ext4 filesystems. An attacker could exploit this flaw by providing a crafted ext4 filesystem image through USB, SD card, or network boot. During the process of filesystem parsing at boot time, this could result in heap out-of-bounds reads, allowing potential access to arbitrary memory regions, which may further compromise system integrity.

References