Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Execute Code at Boot

Researchers at firmware security firm Binarly have discovered six new vulnerabilities in U-Boot, the widely used bootloader for devices ranging from home routers and smart cameras to data-center server management chips. The flaws, tracked as Binarly advisories BRLY-2026-037 through BRLY-2026-042, affect U-Boot versions since v2013.07 and numerous vendor firmwares built on top of it.

Four of the bugs can crash a device, while two (BRLY-2026-037 and BRLY-2026-038) could allow an attacker who delivers a malicious FIT (Flattened Image Tree) image to execute arbitrary code before the bootloader verifies the image’s digital signature. Both code-execution flaws stem from an unchecked return value in the fdt_get_name function from the libfdt library, leading to a stack buffer overflow or return address overwrite under specific memory layouts.

The remaining four flaws cause denial of service: BRLY-2026-039 and BRLY-2026-041 involve out-of-bounds reads via attacker-controlled sizes or offsets; BRLY-2026-040 dereferences a null pointer from an older image format; and BRLY-2026-042 exhausts the stack through deeply nested images.

Binarly has published proof-of-concept images and reproduction steps for each flaw, demonstrating them against standard U-Boot builds. No active exploitation has been reported. The code-execution bugs are the most critical, as they could subvert the entire chain of trust below the operating system, potentially evading security tools. However, exploitation typically requires physical access or a privileged foothold to deliver the malicious image.

U-Boot merged patches in June 2026, but the v2026.07 release shipped without them due to a prior freeze; the next stable release is v2026.10 in October. Vendors are urged to apply upstream fixes immediately. This follows a similar issue, CVE-2026-33243, patched in April 2026, and echoes broader bootloader security concerns like LogoFAIL (2023) and BootHole (2020).