[ADVISORY] Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-08-30 06:18 UTC
Importiert: 2026-09-04 00:48 UTC
CVSS: 9.8
Quelle-ID: full_disc
uid_hash: 5f7cd8eb16dc68be20aae774f3e6392135a6f9e32ae886d9aa90eef31889df61

Full Disclosure

Posted by t.preissl via Fulldisclosure on Aug 29 -----BEGIN SECURITY ADVISORY-----

Title: Multiple Integer Overflows in U-Boot Filesystem Handling

Author: Timo Preißl <t.preissl () proton me>

Date: 2026-02-11

CVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293

Affected: Denx U-Boot <= v2026.01-rc4

Fixed in: v2026.04-rc1 (commit adccdb2)

== Overview ==

Multiple integer overflow vulnerabilities were discovered in the U-Boot

bootloader's filesystem handling code...

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	Veroeffentlicht (CVE.org)
CVE-2025-70290	CRITICAL	9.8	CRITICAL	9.8	2026-08-26
CVE-2025-70291	CRITICAL	9.8
CVE-2025-70292	CRITICAL	9.8
CVE-2025-70293	CRITICAL	9.8	CRITICAL	9.8	2026-08-26

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss