CVE-2026-33243 - Vulnerability Analysis

Overview

barebox 2016.03.0 to < 2025.09.3 and 2025.10.0 to < 2026.03.1 contains a signature bypass caused by unhashed mutable hashed-nodes property in FIT signature node, letting attackers trick the bootloader into booting unverified images, exploit requires attacker to modify FIT image.

Severity & Score

Impact

Attackers can trick the bootloader into booting unverified images, potentially compromising system integrity and security.

Mitigation

Update to versions 2025.09.3 or 2026.03.1 or later.

References

• https://github.com/barebox/barebox/commit/aca01795056d51060cb096f9a1ea309361743e05
• https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner