CVE-2026-71973
Medium
Description
U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablks_count value that causes heap buffer under-allocation and out-of-bounds writes, corrupting heap memory and crashing the bootloader.
SeverityMedium
CVSS5.2
Exploit probability—
ProductU-boot
PublishedSep 29, 2026
First seenSep 29, 2026
Weakness typeCWE-190Integer overflow
How to fix
Update
- u-boot u-boot2026.10-rc4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| u-boot u-boot | v < 2026.10-rc4 | 2026.10-rc4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.