Six U-Boot Flaws Could Crash Devices or Enable Code Execution Before Signature Checks
Summary
Binarly disclosed six U-Boot FIT image verification flaws: four can crash the bootloader and two could enable code execution before signature checks. No CVEs are assigned; patches are merged, but vendors must deliver fixes.
Key points
- The flaws affect U-Boot’s FIT image verification path and are tracked as BRLY-2026-037 through BRLY-2026-042; no CVE identifiers have been assigned.
- Two flaws could enable attacker-controlled code execution before signature verification; four can crash the bootloader.
- The issues are triggered while U-Boot processes an untrusted image. Reaching the boot path generally requires physical access or a privileged foothold.
- Binarly says much of the vulnerable code has existed since U-Boot v2013.07 and appears in vendor firmware built on U-Boot.
- Binarly published proof-of-concept images and reproduction steps and demonstrated the flaws against standard U-Boot builds; no real-world exploitation was reported.
- U-Boot merged patches in June, but the v2026.07 release shipped without them. Vendors and maintainers are urged to apply the upstream fixes; product users must wait for vendor firmware updates.
Article Details
- Vulnerability Types
- Stack buffer overflow
- Out-of-bounds read
- Null-pointer dereference
- Stack exhaustion
- Affected Versions
- U-Boot versions dating back to v2013.07
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- partial