# CVE-2026-33243

## Summary

- **CVE ID:** CVE-2026-33243
- **Severity:** HIGH
- **CVSS Score:** 8.3 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
- **CWE:** CWE-345
- **Published:** Mar 20, 2026
- **Last Modified:** Mar 26, 2026

## Description

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2025.09.3 and from version 2025.10.0 to before version 2026.03.1, when creating a FIT, mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and can therefore be modified by an attacker to trick the bootloader into booting different images than those that have been verified. This issue has been patched in barebox versions 2025.09.3 and 2026.03.1.

## Affected Products

- barebox — barebox (>= 2016.03.0, < 2025.09.3)
- barebox — barebox (>= 2025.10.0, < 2026.03.1)

## References

- [CNA](https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4)
- [CNA](https://github.com/barebox/barebox/commit/aca01795056d51060cb096f9a1ea309361743e05)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.11%
- **EPSS Percentile:** 1.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._