Denx U-boot vulnerabilities

• denx u-boot U-Boot < 2026.07-rc2 Buffer Overflow in nfs_readlink_reply() via NFS READLINK CVE-2026-29009 Fix available 8.8 HighJuly 8, 2026
• denx u-boot U-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_machine() CVE-2026-29008 8.7 HighJuly 8, 2026
• denx u-boot U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c CVE-2026-29007 6.9 MediumJuly 8, 2026
• denx u-boot Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because... CVE-2026-46728 Fix available 8.2 HighMarch 20, 2026
• denx u-boot Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot... CVE-2025-24857 Fix available 7.6 HighDecember 10, 2025
• denx u-boot A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U... CVE-2025-45512 Public exploit 6.5 MediumAugust 5, 2025
• denx u-boot sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap... CVE-2024-57259 Fix available 7.1 HighFebruary 18, 2025
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted... CVE-2024-57258 Fix available 7.1 HighFebruary 18, 2025
• denx u-boot A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted... CVE-2024-57257 Fix available 2.0 LowFebruary 18, 2025
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc ... CVE-2024-57256 Fix available 7.1 HighFebruary 18, 2025
• denx u-boot An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted... CVE-2024-57255 Fix available 7.1 HighFebruary 18, 2025
• denx u-boot An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink... CVE-2024-57254 Fix available 7.1 HighFebruary 18, 2025
• denx u-boot Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 ... CVE-2024-42040 Fix available 8.1 HighAugust 23, 2024
• denx u-boot, rad secflow-2v firmware +1 more RAD SecFlow-2 devices with Hardware 0202, Firmware 4.1.01.63, and U-Boot 2010.12 allow URIs... CVE-2019-6268 7.5 HighMarch 8, 2024
• denx u-boot, uboot, siemens ruggedcom rox mx5000 +10 more +12 more Unchecked Download size in Uboot CVE-2022-2347 Fix available 7.7 HighSeptember 23, 2022
• denx u-boot squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains... CVE-2022-33967 Fix available 7.8 HighJuly 20, 2022
• denx u-boot Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the... CVE-2022-33103 Fix available 7.8 HighJuly 1, 2022
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer... CVE-2022-34835 Fix available 9.8 CriticalJune 29, 2022
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more Das U-Boot 2022.01 has a Buffer Overflow. CVE-2022-30552 Fix available 5.5 MediumJune 8, 2022
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552. CVE-2022-30790 Fix available 7.8 HighJune 8, 2022
• denx u-boot, fedoraproject fedora +1 more nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an... CVE-2022-30767 Fix available 9.8 CriticalMay 16, 2022
• denx u-boot The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT. CVE-2021-27138 Fix available 7.8 HighFebruary 17, 2021
• denx u-boot The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT. CVE-2021-27097 Fix available 7.8 HighFebruary 17, 2021
• denx u-boot, opensuse leap, siemens ruggedcom rox mx5000 +10 more +12 more Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently... CVE-2020-10648 Fix available 7.8 HighMarch 19, 2020
• denx u-boot, opensuse leap +1 more In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts(... CVE-2020-8432 Fix available 9.8 CriticalJanuary 29, 2020
• denx u-boot, opensuse leap, siemens ruggedcom rox mx5000 +10 more +12 more Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a... CVE-2019-13106 Fix available 7.8 HighAugust 6, 2019
• denx u-boot Das U-Boot versions 2019.07-rc1 through 2019.07-rc4 can double-free a cached block of data when... CVE-2019-13105 Fix available 7.8 HighAugust 6, 2019
• denx u-boot, opensuse leap, siemens ruggedcom rox mx5000 +10 more +12 more In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to... CVE-2019-13104 Fix available 7.8 HighAugust 6, 2019
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an... CVE-2019-14193 Fix available 9.8 CriticalJuly 31, 2019
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing... CVE-2019-14199 Fix available 9.8 CriticalJuly 31, 2019
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed... CVE-2019-14196 Fix available 9.8 CriticalJuly 31, 2019
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An issue was discovered in Das U-Boot through 2019.07. There is a read of out-of-bounds data at... CVE-2019-14197 Fix available 9.1 CriticalJuly 31, 2019
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed... CVE-2019-14198 Fix available 9.8 CriticalJuly 31, 2019
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with... CVE-2019-14195 Fix available 9.8 CriticalJuly 31, 2019
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed... CVE-2019-14194 Fix available 9.8 CriticalJuly 31, 2019
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing... CVE-2019-14192 Fix available 9.8 CriticalJuly 31, 2019
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in... CVE-2019-14200 Fix available 9.8 CriticalJuly 31, 2019
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in... CVE-2019-14201 Fix available 9.8 CriticalJuly 31, 2019
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in... CVE-2019-14202 Fix available 9.8 CriticalJuly 31, 2019
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in... CVE-2019-14203 Fix available 9.8 CriticalJuly 31, 2019
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in... CVE-2019-14204 Fix available 9.8 CriticalJuly 31, 2019
• denx u-boot, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07... CVE-2019-13103 Fix available 7.1 HighJuly 29, 2019
• denx u-boot Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a... CVE-2019-11059 Fix available 9.8 CriticalMay 10, 2019
• denx u-boot gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which... CVE-2019-11690 Fix available 5.9 MediumMay 3, 2019
• denx u-boot An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from... CVE-2018-3968 Fix available 8.2 HighMarch 21, 2019
• denx u-boot DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel... CVE-2018-18440 7.8 HighNovember 20, 2018
• denx u-boot DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious TFTP... CVE-2018-18439 9.8 CriticalNovember 20, 2018
• das u-boot Das U-Boot's AES-CBC encryption feature improperly handles an error condition and may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data CVE-2017-3226 6.4 MediumJuly 24, 2018
• das u-boot Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector that may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data CVE-2017-3225 4.6 MediumJuly 24, 2018
• denx u-boot U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature... CVE-2018-1000205 5.5 MediumJune 26, 2018