By vendor

Denx vulnerabilities

Known CVEs affecting Denx products, prioritized by severity, with SEC.co remediation and detection guidance.

3 published vulnerabilities

• CVE-2026-29009HIGH 8.2

  U-Boot, the widely-used bootloader for embedded systems, contains a buffer overflow vulnerability in its NFS (Network File System) implementation when NFS support is enabled. A malicious or compromised NFS server can trigger the vulnerability by sending specially crafted file symlink responses that exceed the bootloader's internal buffer capacity. This causes memory corruption that can affect critical NFS configuration variables, potentially allowing an attacker to disrupt or manipulate the boot process. The vulnerability requires network access to an NFS server that the target device trusts, making it relevant primarily in environments where U-Boot devices boot from untrusted or compromised network sources.

• CVE-2026-29008HIGH 7.5

  U-Boot bootloaders through version 2026.04-rc3 are vulnerable to a crash triggered by a specially crafted network packet. An attacker on the same network can send a malformed TCP packet that causes the bootloader to crash during the boot process, preventing devices from starting up. The vulnerability stems from improper handling of packet data size calculations that can result in memory operations exceeding intended boundaries.

• CVE-2026-29007MEDIUM 5.3

  U-Boot versions through 2026.04-rc3 contain a flaw in how they process incoming TCP network packets when TCP networking is enabled. An attacker can send a specially crafted packet with mismatched length fields to trick U-Boot into reading data beyond the actual packet boundaries. This can corrupt internal TCP connection variables, potentially disrupting network communication and causing denial of service. The vulnerability requires no authentication and can be triggered from any network-connected attacker.