Browse CVEs

CRITICAL 9.8 CVE-2026-29009 U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowin… U Boot 2026.04+ Fix from $2,3002026-07-08 HIGH 7.5 CVE-2026-29008 U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjac… U Boot 2026.04+ Fix from $1,9502026-07-08 MEDIUM 5.3 CVE-2026-29007 U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowi… U Boot 2026.04+ Fix from $1,6002026-07-08 HIGH 8.8 CVE-2026-46728 Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash. U Boot 2025.09.3 / 2026.03.1+ Fix from $1,9502026-05-16 HIGH 8.2 CVE-2026-33243 barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker cou… U Boot 2025.09.3 / 2026.03.1+ Fix from $1,9502026-03-20 HIGH 7.6 CVE-2025-24857 Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018… U Boot 2017.11+ Fix from $1,9502025-12-10 MEDIUM 6.5 CVE-2025-45512 A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attackers to install crafted firmwa… U Boot No fix yet Fix from $1,6002025-08-05 HIGH 7.8 CVE-2024-57258 Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or becaus… U Boot after 2024.10 Fix from $1,9502025-02-18 MEDIUM 6.8 CVE-2024-57254 An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem. U Boot after 2024.10 Fix from $1,6002025-02-18 MEDIUM 6.8 CVE-2024-57255 An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xfffffff… U Boot after 2024.10 Fix from $1,6002025-02-18 MEDIUM 6.8 CVE-2024-57256 An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 fil… U Boot after 2024.10 Fix from $1,6002025-02-18 MEDIUM 6.8 CVE-2024-57259 sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing bec… U Boot after 2024.10 Fix from $1,6002025-02-18 HIGH 8.1 CVE-2024-42040 Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an atta… U Boot after 2025.10 Fix from $1,9502024-08-23 HIGH 7.1 CVE-2022-2347 There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and… U Boot after 2022.07 Fix from $1,9502022-09-23 HIGH 7.8 CVE-2022-33967 squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a … U Boot Patch available Fix from $1,9502022-07-20 HIGH 7.8 CVE-2022-33103 Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs_readdir(). U Boot 2022.07+ Fix from $1,9502022-07-01 CRITICAL 9.8 CVE-2022-34835 In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the corrupti… U Boot 2022.07+ Fix from $2,3002022-06-30 HIGH 7.8 CVE-2022-30790 Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552. U Boot No fix yet Fix from $1,9502022-06-08 MEDIUM 5.5 CVE-2022-30552 Das U-Boot 2022.01 has a Buffer Overflow. U Boot No fix yet Fix from $1,6002022-06-08 HIGH 7.8 CVE-2021-27097 The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT. U Boot after 2021.01 Fix from $1,9502021-02-17 HIGH 7.8 CVE-2021-27138 The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT. U Boot after 2021.01 Fix from $1,9502021-02-17 HIGH 7.8 CVE-2020-10648 Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT im… U Boot 2018.03+ Fix from $1,9502020-03-19 CRITICAL 9.8 CVE-2020-8432 In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-wha… U Boot after 2020.01 Fix from $2,3002020-01-29 HIGH 7.8 CVE-2019-13105 Das U-Boot versions 2019.07-rc1 through 2019.07-rc4 can double-free a cached block of data when listing files in a crafted ext4 filesystem. U Boot Patch available Fix from $1,9502019-08-06 HIGH 7.8 CVE-2019-13106 Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer o… U Boot after 2019.04 Fix from $1,9502019-08-06 HIGH 7.8 CVE-2019-13104 In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to overwrite a very large amount of data (including the whole… U Boot after 2019.04 Fix from $1,9502019-08-06 CRITICAL 9.8 CVE-2019-14204 An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_umountal… U Boot after 2019.07 Fix from $2,3002019-07-31 CRITICAL 9.8 CVE-2019-14192 An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet in… U Boot after 2019.07 Fix from $2,3002019-07-31 CRITICAL 9.8 CVE-2019-14193 An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an unvalidated length at nfs_readlink_reply, in the "if" blo… U Boot after 2019.07 Fix from $2,3002019-07-31 CRITICAL 9.8 CVE-2019-14194 An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_b… U Boot after 2019.07 Fix from $2,3002019-07-31