Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c. Attackers can supply a malicious ext4 filesystem image via USB, SD card, or network boot to trigger heap out-of-bounds reads during boot-time filesystem parsing, potentially redirecting reads to arbitrary disk offsets.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34961 Out-of-Bounds Read Vulnerability in barebox ext4 Extent Parsing Before 2026.04.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34961
Post summary
The post announces CVE‑2026‑34961, an out‑of‑bounds read vulnerability in barebox ext4 extent parsing before version 2026.04.0, with a reference to detailed information at vulmon.com.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pengutronix | barebox | - | - | - |