Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcp_message_type() function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet without a proper 0xff end marker to cause the parser to read past valid packet data and potentially crash the system.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34960 Out-of-Bounds Read in barebox DHCP Option Parsing Prior to 2026.04.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34960
Post summary
The text announces CVE-2026-34960, an out-of-bounds read vulnerability in barebox DHCP option parsing before version 2026.04.0, without providing PoC details, exploits, patch information, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pengutronix | barebox | - | - | - |