CVE-2019-13106

Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a...

7.8 HighFix available

Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.76%Down 0.4 points since Apr 14, 2021

What each source reports

NVD Score used 7.8

Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution.

Record: CVE-2019-13106
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 8.3 HighAV:N/AC:M/Au:N/C:P/I:P/A:C
Weakness: CWE-787
Updated: 2026-11-02

CVE List No score

Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution.

Record: CVE-2019-13106
Updated: 2026-11-02

EUVDEUVD-2019-4647 No score

Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution.

Record: EUVD-2019-4647
Updated: 2026-11-02

GitHub AdvisoriesGHSA-r4g9-3p6p-387v 7.8

Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a...

Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution.

Record: GHSA-r4g9-3p6p-387v
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSV 7.8

Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution.

Record: CVE-2019-13106
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-13106 7.8

Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution.

Record: DEBIAN-CVE-2019-13106
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSVUBUNTU-CVE-2019-13106 7.8

Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution.

Record: UBUNTU-CVE-2019-13106
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2019:2233-1 No score

Security update for u-boot

This update for u-boot fixes the following issues:

Security issues fixed:

CVE-2019-13106: Fixed stack buffer overflow via a crafted ext4 filesystem that may lead to code execution (bsc#1144656).
CVE-2019-13104: Fixed an underflow that could cause memcpy() to overwrite a very large amount of data via a crafted ext4 filesystem (bsc#1144675).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Record: openSUSE-SU-2019:2233-1
Updated: 2026-11-02

OSVopenSUSE-SU-2019:2235-1 No score

Security update for u-boot

This update for u-boot fixes the following issues:

Security issues fixed:

CVE-2019-13106: Fixed stack buffer overflow via a crafted ext4 filesystem that may lead to code execution (bsc#1144656).
CVE-2019-13104: Fixed an underflow that could cause memcpy() to overwrite a very large amount of data via a crafted ext4 filesystem (bsc#1144675).

This update was imported from the SUSE:SLE-15:Update update project.

Record: openSUSE-SU-2019:2235-1
Updated: 2026-11-02

OSVSUSE-SU-2019:2474-1 No score

Security update for u-boot

This update for u-boot fixes the following issues:

Security issues fixed:

CVE-2019-13106: Fixed stack buffer overflow via a crafted ext4 filesystem that may lead to code execution (bsc#1144656).
CVE-2019-13104: Fixed an underflow that could cause memcpy() to overwrite a very large amount of data via a crafted ext4 filesystem (bsc#1144675).

Record: SUSE-SU-2019:2474-1
Updated: 2026-11-02

OSVSUSE-SU-2019:2475-1 No score

Security update for u-boot

This update for u-boot fixes the following issues:

Security issues fixed:

CVE-2019-13106: Fixed stack buffer overflow via a crafted ext4 filesystem that may lead to code execution (bsc#1144656).
CVE-2019-13104: Fixed an underflow that could cause memcpy() to overwrite a very large amount of data via a crafted ext4 filesystem (bsc#1144675).

Record: SUSE-SU-2019:2475-1
Updated: 2026-11-02

OSVSUSE-SU-2020:3256-1 No score

Security update for u-boot

This update for u-boot fixes the following issues:

Fix CVE-2019-13106 (bsc#1144656), CVE-2019-13104 (bsc#1144675), CVE-2019-14192 (bsc#1143777), CVE-2019-14193 (bsc#1143817), CVE-2019-14199 (bsc#1143824), CVE-2019-14197 (bsc#1143821), CVE-2019-14200 (bsc#1143825), CVE-2019-14201 (bsc#1143827), CVE-2019-14202 (bsc#1143828), CVE-2019-14203 (bsc#1143830), CVE-2019-14204 (bsc#1143831), CVE-2019-14194 (bsc#1143818), CVE-2019-14198 (bsc#1143823), CVE-2019-14195 (bsc#1143819), CVE-2019-14196 (bsc#1143820), CVE-2019-13103 (bsc#1143463), CVE-2020-8432 (bsc#1162198), CVE-2019-11059 (bsc#1134853), CVE-2019-11690 (bsc#1134157) and CVE-2020-10648 (bsc#1167209)

Record: SUSE-SU-2020:3256-1
Updated: 2026-11-02

Affected products

Show 1 moreShow less

siemens ruggedcom rox rx5000

Affected packages

Affected packages
Package	Affected	Fixed
`u-boot` Debian:12	before 2020.01+dfsg-1	2020.01+dfsg-1
`u-boot` Debian:13	before 2020.01+dfsg-1	2020.01+dfsg-1
`u-boot` Debian:14	before 2020.01+dfsg-1	2020.01+dfsg-1
`u-boot` SUSE:Linux Enterprise Module for Basesystem 15	before 2018.03-4.3.1	2018.03-4.3.1
`u-boot-rpi3` SUSE:Linux Enterprise Module for Basesystem 15	before 2018.03-4.3.1	2018.03-4.3.1
`u-boot` SUSE:Linux Enterprise Module for Basesystem 15 SP1	before 2019.01-7.3.1	2019.01-7.3.1
`u-boot-rpi3` SUSE:Linux Enterprise Module for Basesystem 15 SP1	before 2019.01-7.3.1	2019.01-7.3.1
`u-boot` SUSE:Linux Enterprise Server 12 SP4-LTSS	before 2018.03-4.3.1	2018.03-4.3.1
`u-boot-rpi3` SUSE:Linux Enterprise Server 12 SP4-LTSS	before 2018.03-4.3.1	2018.03-4.3.1
`u-boot` Ubuntu:18.04:LTS	before 2020.10+dfsg-1ubuntu0~18.04.2, plus listed versions 2016.03+dfsg1-6ubuntu22018.07~rc3+dfsg1-0ubuntu1~18.04.12018.07~rc3+dfsg1-0ubuntu2~18.04.12018.07~rc3+dfsg1-0ubuntu3~18.04.12019.07+dfsg-1ubuntu4~18.04.1	2020.10+dfsg-1ubuntu0~18.04.2
`u-boot` Ubuntu:20.04:LTS	before 2021.01+dfsg-3ubuntu0~20.04.3, plus listed versions 2019.07+dfsg-1ubuntu32019.07+dfsg-1ubuntu52019.07+dfsg-1ubuntu62020.10+dfsg-1ubuntu0~20.04.22021.01+dfsg-3ubuntu0~20.04.1	2021.01+dfsg-3ubuntu0~20.04.3
`u-boot` openSUSE:Leap 15.1	before 2019.01-lp151.6.3.1	2019.01-lp151.6.3.1
`u-boot` openSUSE:Leap 15.0	before 2018.03-lp150.4.3.1	2018.03-lp150.4.3.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-13106 is a high vulnerability (CVSS 7.8) in Denx U-boot, published August 6, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.76%, the 78th percentile. Fixed in u-boot 2020.01+dfsg-1.

References

Show 51 moreShow less