CVE-2026-34960 — Out-of-Bounds $1

title: CVE-2026-34960 - Out-of-Bounds Read in barebox DHCP Option Parsing
id: scw-2026-05-11-ai-1
status: experimental
level: high
description: |
  This rule detects potential exploitation of CVE-2026-34960. The vulnerability lies in the barebox DHCP client's parsing of DHCP options. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet without a proper 0xff end marker. This rule looks for DHCP OFFER or ACK packets (dst_port 67) originating from the broadcast address (src_ip 0.0.0.0) that do not contain the expected 0xff end marker in the query, indicating a potential attempt to trigger the out-of-bounds read vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-11
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-34960/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: firewall
detection:
  selection:
      dst_port:
          - 67
      src_ip|contains:
          - '0.0.0.0'
  selection_indicators:
      action|contains:
          - 'OFFER'
          - 'ACK'
      query|contains:
          - '0xff'
  condition: selection AND selection_indicators
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse