CVEFinder.io

CVE-2026-33243

⚠️ high
Summary

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified la

Description

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and could therefore be modified to allow booting different images than those that have been verified. This issue has been patched in barebox versions 2026.03.1 and backported to 2025.09.3.

CVSS Score
8.2
High
EPSS Score
0.1
Exploit Probability
Published Date
2026-03-20
First Seen: 2026-03-21
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 79.1% of all 365,890 vulnerabilities in our database.

#76,347
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Mar 24, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2026-09-11
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-345

📦 Affected Products 4

Vendor Product Status Affected Versions
denx u-boot Affected
> 2013.07 < 2026.04
denx u-boot Affected
v2026.04
pengutronix barebox Affected
> 2016.03.0 < 2025.09.3
pengutronix barebox Affected
> 2025.10.0 < 2026.03.1

🔗 References 2

https://github.com/barebox/barebox/commit/aca0179505...
Patch
https://github.com/barebox/barebox/security/advisori...
Patch Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-29007 🔶 medium 5.3 0.6 U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFI... 2026-07-08
CVE-2026-29008 ⚠️ high 7.5 0.6 U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c... 2026-07-08
CVE-2026-29009 ⚠️ high 8.2 0.6 U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFI... 2026-07-08
CVE-2026-46728 ⚠️ high 8.2 0.2 Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted fro... 2026-05-16
CVE-2026-34960 🔶 medium 6.5 0.3 barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcp_m... 2026-05-11
CVE-2026-34961 🔶 medium 6.2 0.2 barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing val... 2026-05-11
These CVEs affect the same products