CVE-2026-33243

CVE Enrichment

CVSS: 8.2 HIGH
EPSS: 0.11%
EPSS Percentile: 1.35%
CISA KEV: Not listed

Description

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and could therefore be modified to allow booting different images than those that have been verified. This issue has been patched in barebox versions 2026.03.1 and backported to 2025.09.3.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 21-Mar-2026 06:16
Last Modified: 11-Sep-2026 22:55
EPSS Date: 2026-10-28
CWE: CWE-345

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:H /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

pengutronix / barebox Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2016.03.0 · before (exclusive) 2025.09.3
cpe:2.3:a:pengutronix:barebox:*:*:*:*:*:*:*:*
pengutronix / barebox Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2025.10.0 · before (exclusive) 2026.03.1
cpe:2.3:a:pengutronix:barebox:*:*:*:*:*:*:*:*

References

Last enrichment sync: 29-Oct-2026 03:19
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

The same signature logic was hit months earlier by CVE-2026-33243, which U-Boot patched in April; the related barebox bootloader, which uses the same image tooling, was hit too. Six U-Boot Flaws Could Crash Devices or Enable Code Execution Before Signature Checks

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.