Executive Summary

This vulnerability exists in barebox versions prior to 2026.04.0 and involves out-of-bounds read errors during ext4 filesystem extent parsing. Specifically, the vulnerability arises because the eh_entries field is not properly validated against the buffer capacity in the ext4_common.c file. An attacker can exploit this by providing a malicious ext4 filesystem image through USB, SD card, or network boot, causing the system to perform heap out-of-bounds reads during boot-time filesystem parsing.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker can trigger heap out-of-bounds reads, potentially redirecting reads to arbitrary disk offsets. This can lead to unauthorized access to data or system instability during the boot process. The CVSS v3.1 score indicates a moderate severity with a base score of 6.2, highlighting that the vulnerability can cause high impact on availability but does not directly affect confidentiality or integrity.

Useful 0 Not Useful 0