Barebox vulnerabilities
We track 3 vulnerabilities in Barebox products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 11, 2026.
Latest Barebox vulnerabilities
- 7.8 High severity
barebox: Integer Overflow or Wraparound
barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersi
- 7.7 High severity
barebox: Out-of-bounds Read
barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c. Attackers can supply a malicious ext4 filesystem image via
- 8.2 High severity
barebox: Insufficient Verification of Data Authenticity
barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images tha