CVE-2020-13910: Pengutronix Barebox

Critical severity, CVSS 9.1. EPSS: 1.2% chance of exploitation in the next 30 days.

Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a field of an incoming network packet is directly used as a length field without any bounds check.

Affected products

• Pengutronix Barebox: up to and including 2020.05.0

Published 2020-06-07. Last modified 2026-06-17.