CVE-2026-34961

Name of the Vulnerable Software and Affected Versions barebox versions prior to 2026.04.0

Description An out-of-bounds read exists in the ext4 extent parsing process due to missing validation of the eh entries field against buffer capacity within the fs/ext4/ext4 common.c file. An attacker can trigger heap out-of-bounds reads during boot-time filesystem parsing by providing a malicious ext4 filesystem image via USB, SD card, or network boot, which may allow redirecting reads to arbitrary disk offsets.

Recommendations Update to version 2026.04.0 or later.