CVE-2026-71972

Received Received - Intake

U-Boot Out-of-Bounds Write in RLE8 BMP Handling

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulnCheck

Description

U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-09-30

AI Q&A

2026-09-30

EPSS Evaluated

N/A

NVD

CVE-2026-71972

Affected Vendors & Products

Vendor	Product	Version / Range
u-boot	u-boot	to 2026.10-rc5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds write flaw in U-Boot versions up to 2026.10-rc5. It occurs in the video_display_rle8_bitmap function when processing RLE8-compressed BMP images. Attackers can exploit this by providing a specially crafted image to corrupt memory near the framebuffer, causing the bootloader to crash.

Detection Guidance

Detection requires analyzing U-Boot versions and BMP image handling. Check U-Boot version with 'strings u-boot.bin | grep U-Boot' or 'strings u-boot.img | grep U-Boot'. Inspect BMP images for RLE8 compression using tools like 'file' or 'binwalk'. Monitor bootloader crashes during image processing.

Impact Analysis

If exploited, this vulnerability could allow attackers to crash the U-Boot bootloader during system startup. This may prevent the device from booting properly, leading to denial of service. It could also potentially enable further exploitation if combined with other vulnerabilities.

Mitigation Strategies

Update U-Boot to version 2026.10-rc5 or later. Avoid loading untrusted BMP images in U-Boot. Implement strict input validation for BMP files. Disable RLE8 compression support if not required. Monitor vendor advisories for patches.

Hi! I’m here to help you understand CVE-2026-71972. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70