CVE-2026-71974: U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read
U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition() that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on devices without Android Verified Boot protection.
Affected Software
Event History
Frequently Asked Questions
Which devices are most exposed to this issue?
Devices that boot Android images through the affected U-Boot Android boot method and lack Android Verified Boot protection are exposed. Exploitation requires physical access to provide crafted boot media.
What does an attacker need to do to exploit it?
An attacker needs to supply boot media containing an Android image with an oversized header. The vulnerable partition-read path can then write beyond the load buffer into bootloader memory.
Is Android Verified Boot relevant to exposure?
Yes. The described attack applies to devices without Android Verified Boot protection. Verified Boot can prevent acceptance of the crafted boot media used by this attack.
What version contains the fix?
The issue affects U-Boot versions before 2026.10-rc3. Updating to 2026.10-rc3 or a later version includes the referenced fix.