The flaw resides in barebox’s parsing of ext4 extent structures. When the eh_entries value is not validated against the buffer size in fs/ext4/ext4_common.c, an attacker can supply a crafted ext4 image via USB, SD card, or network boot that triggers a heap out-of-bounds read during boot-time parsing. This may cause the kernel to read memory at arbitrary disk offsets, potentially exposing sensitive data or facilitating further compromise.

All barebox releases before v2026.04.0 are affected. The vulnerability is documented for the barebox:barebox product line and impacts any embedded device that boots from ext4 images using external media or network boot.

The CVSS score of 6.9 indicates a moderate risk; the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known public exploits. The attack vector requires physical or network boot access to supply a malicious filesystem. While the risk is not high, the possibility of data disclosure warrants prompt remediation.