CVE-2026-29009 | High | 8.2 | 2026-07-08 | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malici… |
CVE-2026-29008 | High | 7.5 | 2026-07-08 | U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attack… |
CVE-2026-29007 | Medium | 5.3 | 2026-07-08 | U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote… |
CVE-2026-46728 | High | 8.2 | 2026-05-16 | Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash. |
CVE-2026-33243 | High | 8.2 | 2026-03-20 | barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit… |
CVE-2025-24857 | High | 7.6 | 2025-12-10 | Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322… |
CVE-2025-45512 | Medium | 6.5 | 2025-08-05 | A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attackers to install crafted firmware files… |
CVE-2024-57259 | High | 7.1 | 2025-02-18 | sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the p… |
CVE-2024-57258 | High | 7.1 | 2025-02-18 | Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_… |
CVE-2024-57257 | Low | 2.0 | 2025-02-18 | A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting. |
CVE-2024-57256 | High | 7.1 | 2025-02-18 | An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem wi… |
CVE-2024-57255 | High | 7.1 | 2025-02-18 | An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulti… |
CVE-2024-57254 | High | 7.1 | 2025-02-18 | An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem. |
CVE-2024-42040 | High | 8.1 | 2024-08-23 | Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on th… |
CVE-2022-2347 | High | 7.7 | 2022-09-23 | There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does n… |
CVE-2022-33967 | High | 7.8 | 2022-07-20 | squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in… |
CVE-2022-33103 | High | 7.8 | 2022-07-01 | Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs_readdir(). |
CVE-2022-34835 | Critical | 9.8 | 2022-06-30 | In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the corruption of the… |
CVE-2022-30790 | High | 7.8 | 2022-06-08 | Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552. |
CVE-2022-30552 | Medium | 5.5 | 2022-06-08 | Das U-Boot 2022.01 has a Buffer Overflow. |
CVE-2022-30767 | Critical | 9.8 | 2022-05-16 | nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, leading to a buffer o… |
CVE-2021-27138 | High | 7.8 | 2021-02-17 | The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT. |
CVE-2021-27097 | High | 7.8 | 2021-02-17 | The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT. |
CVE-2020-10648 | High | 7.8 | 2020-03-19 | Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a s… |
CVE-2020-8432 | Critical | 9.8 | 2020-01-29 | In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where co… |
CVE-2019-13106 | High | 7.8 | 2019-08-06 | Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow an… |
CVE-2019-13105 | High | 7.8 | 2019-08-06 | Das U-Boot versions 2019.07-rc1 through 2019.07-rc4 can double-free a cached block of data when listing files in a crafted ext4 filesystem. |
CVE-2019-13104 | High | 7.8 | 2019-08-06 | In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to overwrite a very large amount of data (including the whole stack) wh… |
CVE-2019-14204 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_umountall_reply. |
CVE-2019-14203 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_mount_reply. |
CVE-2019-14202 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_readlink_reply. |
CVE-2019-14201 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_lookup_reply. |
CVE-2019-14200 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: rpc_lookup_reply. |
CVE-2019-14199 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer unde… |
CVE-2019-14198 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in th… |
CVE-2019-14197 | Critical | 9.1 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is a read of out-of-bounds data at nfs_read_reply. |
CVE-2019-14196 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_lookup_reply. |
CVE-2019-14195 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with unvalidated length at nfs_readlink_reply in the "else" block after cal… |
CVE-2019-14194 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in th… |
CVE-2019-14193 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an unvalidated length at nfs_readlink_reply, in the "if" block after c… |
CVE-2019-14192 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer unde… |
CVE-2019-13103 | High | 7.1 | 2019-07-29 | A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinite… |
CVE-2019-11059 | Critical | 9.8 | 2019-05-10 | Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a buffer overflow. |
CVE-2019-11690 | Medium | 5.9 | 2019-05-03 | gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CON… |
CVE-2018-3968 | High | 7.0 | 2019-03-21 | An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack prope… |
CVE-2018-18440 | High | 7.8 | 2018-11-20 | DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel image because filesystem loading is mishandled. |
CVE-2018-18439 | Critical | 9.8 | 2018-11-20 | DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious TFTP server because TFTP traffic is mishandled. Also, local exploita… |
CVE-2017-3226 | Medium | 6.4 | 2018-07-24 | Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. Devices that make use of Das U-Boot's AES-CBC encryption feature… |
CVE-2017-3225 | Medium | 4.6 | 2018-07-24 | Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's… |
CVE-2018-1000205 | Medium | 5.5 | 2018-06-26 | U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result in Bypass verified boot. This attack ap… |