Denx Software Engineering U-boot vulnerabilities

• denx software engineering u-boot U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6 CVE-2026-74225 Fix available 7.1 HighSeptember 29, 2026
• denx software engineering u-boot U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback CVE-2026-74222 Fix available 8.8 HighSeptember 29, 2026
• denx software engineering u-boot U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK CVE-2026-74221 Fix available 8.8 HighSeptember 29, 2026
• denx software engineering u-boot U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply CVE-2026-74220 Fix available 8.8 HighSeptember 29, 2026
• denx software engineering u-boot U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read CVE-2026-71974 4.3 MediumSeptember 29, 2026
• denx software engineering u-boot U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation CVE-2026-71973 5.2 MediumSeptember 29, 2026
• denx software engineering u-boot U-Boot through 2026.10-rc5 Out-of-Bounds Write in BMP RLE8 Decoder CVE-2026-71972 6.0 MediumSeptember 29, 2026
• denx software engineering u-boot U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly CVE-2026-71971 Fix available 8.8 HighSeptember 29, 2026
• denx software engineering das u-boot Out-of-bounds write in Das U-Boot CVE-2026-15390 Fix available 9.0 CriticalSeptember 29, 2026
• denx u-boot U-Boot < 2026.07-rc2 Buffer Overflow in nfs_readlink_reply() via NFS READLINK CVE-2026-29009 Fix available 8.8 HighJuly 8, 2026
• denx u-boot U-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_machine() CVE-2026-29008 8.7 HighJuly 8, 2026
• denx u-boot U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c CVE-2026-29007 6.9 MediumJuly 8, 2026
• denx u-boot Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because... CVE-2026-46728 Fix available 8.2 HighMarch 20, 2026
• denx u-boot sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap... CVE-2024-57259 Fix available 7.1 HighFebruary 18, 2025
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted... CVE-2024-57258 Fix available 7.1 HighFebruary 18, 2025
• denx u-boot A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted... CVE-2024-57257 Fix available 2.0 LowFebruary 18, 2025
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc ... CVE-2024-57256 Fix available 7.1 HighFebruary 18, 2025
• denx u-boot An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted... CVE-2024-57255 Fix available 7.1 HighFebruary 18, 2025
• denx u-boot An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink... CVE-2024-57254 Fix available 7.1 HighFebruary 18, 2025
• denx u-boot squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains... CVE-2022-33967 Fix available 7.8 HighJuly 20, 2022
• das u-boot Das U-Boot's AES-CBC encryption feature improperly handles an error condition and may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data CVE-2017-3226 6.4 MediumJuly 24, 2018
• das u-boot Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector that may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data CVE-2017-3225 4.6 MediumJuly 24, 2018