CVE-2025-70293: Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)
Published Aug 26, 2026
·Updated
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fsgetbgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy() which could lead to arbitrary code execution, a denial of service, or other unspecified impacts.
Affected Software
2 affected components
DENX U-Boot<2026.04
debian/u-boot<=2023.01+dfsg-2+deb12u3, <=2025.01-3+deb13u1, <=2025.01-3.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Denx U-Bootto a version that resolves this vulnerability.Fixed in 2026.04
Event History
Aug 26, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeakness
Oct 6, 2026
Data Sourced
via Ubuntu·06:44 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·06:45 PM
DescriptionAffected Software
Data Sourced
via Launchpad·06:45 PM
Description
Frequently Asked Questions
1
Which U-Boot versions fall within the affected range?
DENX U-Boot versions before 2026.04 are affected.