CVE-2026-71974

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Write in U-Boot Bootloader

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: VulnCheck

Description

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on devices without Android Verified Boot protection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-71974

EUVD

EUVD-2026-89432

Affected Vendors & Products

Vendor	Product	Version / Range
denx	uboot	to 2026.10-rc3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

U-Boot before version 2026.10-rc3 has an out-of-bounds write flaw in the read_slotted_partition() function. It fails to check if an image size exceeds partition limits, allowing attackers with physical access to write beyond the intended buffer into bootloader memory. This occurs on devices lacking Android Verified Boot protection when specially crafted boot media with oversized headers is used.

Detection Guidance

This vulnerability requires physical access to exploit and is specific to U-Boot bootloaders without Android Verified Boot protection. Detection involves checking U-Boot versions and examining boot media for oversized headers. No direct network detection commands are applicable.

Impact Analysis

If you use affected U-Boot versions on devices without Android Verified Boot, an attacker with physical access could exploit this to overwrite critical bootloader memory. This may lead to system compromise, unauthorized code execution, or denial of service during boot-up.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves physical access and bootloader memory corruption on devices without Android Verified Boot protection. However, unauthorized bootloader modifications could potentially lead to data breaches or system integrity issues, which may indirectly impact compliance if such breaches involve protected health or personal data.

Mitigation Strategies

Upgrade U-Boot to version 2026.10-rc3 or later. Enable Android Verified Boot protection if available. Restrict physical access to devices. Validate boot media headers before loading.

Hi! I’m here to help you understand CVE-2026-71974. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70