Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and could therefore be modified to allow booting different images than those that have been verified. This issue has been patched in barebox versions 2026.03.1 and backported to 2025.09.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-20 | 1 | General1 |
| 2026-03-21 | 1 | Disclosure1 |
| 2026-05-16 | 1 | Disclosure1 |
I learned about embedded systems security from the recent Barebox/U-Boot vulnerability (CVE-2026-33243). https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4
Post summary
The user cites a newly disclosed CVE-2026-33243 for Barebox/U-Boot and links to its GitHub advisory, but provides no PoC, exploitation, patch, or technical details.
CVE-2026-33243 barebox is a bootloader. In barebox from version 2016.03.0 to before version 2025.09.3 and from version 2025.10.0 to before version 2026.03.1, when creating a FIT, mk… https://www.cve.org/CVERecord?id=CVE-2026-33243
Post summary
The post references CVE‑2026‑33243 for barebox bootloader, listing vulnerable versions, but lacks details on exploitation, protection, or PoC information.
🟠 CVE-2026-33243 - High barebox is a bootloader. In barebox from version 2016.03.0 to before version 2025.09.3 and from version 2025.10.0 to before version 2026.03.1, when creating a FIT, mkimage(1) sets the hashed-... https://www.thehackerwire.com/vulnerability/CVE-2026-33243/ https://t.co/Kb1ZxYEl0a
Post summary
Vulnerability CVE-2026-33243 is disclosed for the barebox bootloader across specific versions, involving mkimage hashing, but no exploitation, PoC, or patch information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pengutronix | barebox | - | - | - |