CVE-2026-34960: barebox Out-of-Bounds Read in DHCP Option Parsing
barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcpmessagetype() function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet without a proper 0xff end marker to cause the parser to read past valid packet data and potentially crash the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bareboxto a version that resolves this vulnerability.Fixed in 2026.04.0 - Compensating control
If immediate upgrade is not possible, reduce exposure to same broadcast domain attackers by isolating the vulnerable system/network segment (e.g., segregate broadcast domains/VLANs so untrusted hosts cannot send DHCP Offer/ACK packets).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34960?
CVE-2026-34960 is classified as a high-severity out-of-bounds read vulnerability.
How do I fix CVE-2026-34960?
To fix CVE-2026-34960, upgrade barebox to version 2026.04.0 or later.
What systems are affected by CVE-2026-34960?
CVE-2026-34960 affects barebox versions prior to 2026.04.0.
What is the impact of CVE-2026-34960?
The impact of CVE-2026-34960 is potential exposure to denial-of-service attacks or remote code execution due to unvalidated packet boundaries.
How does CVE-2026-34960 enable exploitability?
CVE-2026-34960 allows attackers to read memory outside of intended bounds when parsing DHCP options, leading to security vulnerabilities.