CVE-2026-34155

UNKNOWN 0.0

RAUC: Improper Signing of Plain Bundles Exceeding 2 GiB

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB cause an integer overflow which results in a signature which covers only the first few bytes of the payload. Given such a bundle with a legitimate signature, an attacker can modify the part of the payload which is not covered by the signature. This issue has been patched in version 1.15.2.

CWE	CWE-196 CWE-347
Vendor	rauc
Product	rauc
Published	Mar 31, 2026
Last Updated	Mar 31, 2026

Stay Ahead of the Next One

Get instant alerts for rauc rauc

Be the first to know when new unknown vulnerabilities affecting rauc rauc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

rauc / rauc

< 1.15.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rauc/rauc/security/advisories/GHSA-6hj7-q844-m2hx github.com: https://github.com/rauc/rauc/commit/4fb7c798d6ae412344fb8f8d310d773046af3441 github.com: https://github.com/rauc/rauc/releases/tag/v1.15.2