CVE-2026-71973
mediumpriority · track · 21EPSS 0.002 · 8 %ileDEEPSS · scored 2026-10-23
U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablks_count value that causes heap buffer under-allocation and out-of-bounds writes, corrupting heap memory and crashing the bootloader.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.8–5.2
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3660DENX U-Boot: Mehrere SchwachstellenDeutsch2026-09-29csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in DENX U-Boot ausnutzen, um den Speicher zu beschädigen, Denial-of-Service-Zustände herbeizuführen oder andere, nicht näher spezifizierte Angriffe zu starten.
sources
Which sources assert this record, and when.
references (4) nvd
External citations — patches, advisories, analysis.
- https://github.com/u-boot/u-boot
- https://github.com/u-boot/u-boot/blob/v2026.07/fs/squashfs/sqfs.c#L814
- https://github.com/u-boot/u-boot/commit/561ae28cb56a082cfa90c1c421c4955bc215470b
- https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc4-integer-overflow-in-squashfs-directory-table-allocation
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan