CVE-2025-70290

Deferred Deferred - Pending Action

Integer Overflow in U-Boot ZFS Filesystem Support

Publication date: 2026-08-26

Last updated on: 2026-09-09

Assigner: MITRE

Description

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-09

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2025-70290

Affected Vendors & Products

Vendor	Product	Version / Range
denx	uboot	to 2026.04 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is an integer overflow vulnerability in Denx U-Boot's ZFS filesystem support. It occurs when malformed on-disk metadata triggers incorrect memory allocation during the boot process. This can lead to out-of-bounds memory access, potentially causing a system crash or allowing arbitrary code execution.

Detection Guidance

Detection of this vulnerability requires checking the U-Boot version in use. If your system uses U-Boot before 2026.04, it may be vulnerable. Verify the version with 'strings /path/to/uboot | grep U-Boot' or 'uboot-version'. Ensure ZFS filesystem support is enabled and inspect metadata handling for malformed structures.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code during system boot, potentially gaining control over the device. It may also cause unexpected crashes, disrupting normal operations. Systems using affected U-Boot versions with ZFS support are at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level bootloader issue rather than data handling or privacy controls. Compliance impacts would depend on system-specific implementations and whether the vulnerability leads to unauthorized access or data breaches.

Mitigation Strategies

Update Denx U-Boot to version 2026.04 or later to address the integer overflow vulnerability in ZFS filesystem support.

Hi! I’m here to help you understand CVE-2025-70290. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70