Security researcher Timo Preißl has disclosed four integer overflow vulnerabilities in Denx U-Boot, affecting versions up to v2026.01-rc4. These vulnerabilities (CVE-2025-70290 through CVE-2025-70293) reside within various filesystem parsing components including ZFS, SquashFS, EXT4, and the U-Boot shell's directory move command.
The flaws occur due to insufficient validation during memory allocation size calculations, leading to heap-based buffer overflows. If exploited via malformed filesystem images or crafted shell commands, an attacker could achieve arbitrary code execution in the pre-boot environment. Users are advised to update to v2026.04-rc1 or apply the relevant patches from the U-Boot master branch.
Top comments (0)