CVE-2019-15937: Pengutronix Barebox

Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days.

Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length field is directly used for a memcpy.

Affected products

• Pengutronix Barebox: up to and including 2019.08.1

Published 2019-09-05. Last modified 2026-06-17.