CVE-2025-70293

Received Received - Intake

Integer Overflow in U-Boot Leading to Code Execution

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: MITRE

Description

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy() which could lead to arbitrary code execution, a denial of service, or other unspecified impacts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2025-70293

Affected Vendors & Products

Vendor	Product	Version / Range
denx	uboot	to 2026.04 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow issue in Denx U-Boot before version 2026.04. It occurs in the function ext4fs_get_bgdtable where incorrect size calculation leads to under allocation of a buffer. This underallocated buffer is then used in a memcpy operation, which can result in arbitrary code execution, denial of service, or other unspecified impacts.

Impact Analysis

The vulnerability could allow attackers to execute arbitrary code, crash the system, or cause other unintended behavior on devices running vulnerable versions of Denx U-Boot. This may lead to system compromise, data corruption, or service disruption depending on the device's use case.

Compliance Impact

This vulnerability could lead to arbitrary code execution or denial of service, which may compromise data integrity and availability. Such impacts could violate GDPR's requirements for data protection and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Upgrade Denx U-Boot to version 2026.04 or later to address the integer overflow vulnerability in ext4fs_get_bgdtable.

Hi! I’m here to help you understand CVE-2025-70293. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70