Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Das U-Boot FIT Signature Verification Bypass

CVE-2026-46728 · published 5 months ago
Summary

Das U-Boot, a bootloader, has a security weakness that allows attackers to bypass a security check. This could potentially allow malicious code to run on devices that use this bootloader. Update to the latest version to fix this issue.

What to do
  • Update debian u-boot to version 2021.01+dfsg-5+deb11u3.
  • Update debian u-boot to version 2023.01+dfsg-2+deb12u3.
  • Update debian u-boot to version 2025.01-3.2.
  • Update denx u-boot to version 2026.04 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian u-boot < 2021.01+dfsg-5+deb11u3
Fix: upgrade to 2021.01+dfsg-5+deb11u3
Debian:12 debian u-boot < 2023.01+dfsg-2+deb12u3
Fix: upgrade to 2023.01+dfsg-2+deb12u3
Debian:13 debian u-boot All versions
Debian:14 debian u-boot < 2025.01-3.2
Fix: upgrade to 2025.01-3.2
– denx u-boot >= 2013.07, < 2026.04
2026.04
cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*
Ubuntu:Pro:16.04:LTS canonical u-boot All versions
Ubuntu:22.04:LTS canonical u-boot-nezha All versions
Original advisory text
Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.
Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-346Origin Validation Error
Timeline
Published16 May 2026
Updated29 Oct 2026
First seen16 May 2026
Sources
CVE-2026-46728 · NVD
DEBIAN-CVE-2026-46728 · OSV
UBUNTU-CVE-2026-46728 · OSV
Track software like this
Free during beta