Is CVE-2026-33243 actively exploited?

No active exploitation of CVE-2026-33243 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33243 be exploited remotely?

No. CVE-2026-33243 requires local access to exploit.

What is the CVSS score of CVE-2026-33243?

CVE-2026-33243 has a CVSS score of 8.2 (HIGH).

HOME VULNERABILITIESCVE-2026-33243

HIGH

CVE-2026-33243

CWE-345Published: March 20, 2026· Updated: Mar 26, 2026

8.2

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.4th

Official Description

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and could therefore be modified to allow booting different images than those that have been verified. This issue has been patched in barebox versions 2026.03.1 and backported to 2025.09.3.

NVD Source

Technical Analysis

CVE-2026-33243 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.2.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.