CVE-2026-71973 in U-Boot
Summary
by MITRE • 09/30/2026
U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablks_count value that causes heap buffer under-allocation and out-of-bounds writes, corrupting heap memory and crashing the bootloader.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in U-Boot versions prior to 2026.10-rc4 represents a critical security flaw within the filesystem handling subsystem, specifically affecting the SquashFS implementation. This issue resides in the sqfs_read_directory_table function, which is responsible for parsing directory structures from SquashFS images during the boot process. The core technical defect is an integer overflow that occurs when calculating the size of the buffer required to store the directory table metadata. Because the calculation relies on user-controlled input values derived from the filesystem superblock, specifically the metablks_count field, it fails to account for potential arithmetic overflows under specific conditions. This miscalculation leads directly to a heap buffer under-allocation, where the system allocates significantly less memory than is actually required by the subsequent write operations.
When an attacker supplies a maliciously crafted SquashFS image containing a manipulated metablks_count value in its superblock structure, the U-Boot bootloader proceeds with insufficient memory allocation for the directory table data. As the parsing logic continues to execute, it attempts to write the full extent of the directory information into this undersized buffer. This results in out-of-bounds writes that extend beyond the allocated heap region. Such memory corruption can overwrite adjacent heap metadata or critical application variables stored nearby in memory. The immediate operational consequence is typically a crash of the bootloader process due to segmentation faults or corrupted control flow data, effectively causing a denial of service by preventing the system from booting successfully.
From a threat modeling perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Write. The attack vector requires physical access or the ability to inject a modified bootloader image into the target device's storage media, as U-Boot is typically executed during the early stages of system initialization before any operating system security controls are active. This places it within the ATT&CK framework under techniques related to Bootkit execution and firmware manipulation, specifically leveraging supply chain compromise or physical access vectors to achieve initial code execution or denial of service at the lowest privilege level available on the embedded device.
The impact of this vulnerability extends beyond simple availability loss. While immediate exploitation results in a crash, heap corruption can theoretically be leveraged for more sophisticated attacks if the bootloader environment allows for further memory manipulation prior to handing off control to the kernel. An attacker might attempt to overwrite function pointers or return addresses within the U-Boot heap to redirect execution flow, potentially achieving arbitrary code execution before the operating system loads. This undermines the integrity of the entire boot chain and compromises the trust anchor established by secure boot mechanisms if they are not properly configured to validate filesystem structures with strict bounds checking.
Mitigation strategies primarily involve upgrading to U-Boot version 2026.10-rc4 or later, where this integer overflow has been addressed through proper input validation and safe arithmetic operations during buffer size calculation. Developers should ensure that all inputs derived from external storage media are validated against expected maximums before being used in memory allocation functions. Additionally implementing static analysis tools configured to detect potential integer overflows in C code can help identify similar vulnerabilities early in the development lifecycle. For deployed systems where immediate patching is not feasible, restricting physical access and enforcing strict verification of bootloader images using cryptographic signatures remains a critical defense-in-depth measure to prevent the loading of maliciously crafted filesystems that could trigger this flaw.