https://reddit.com/r/netsec/comments/1wvyt5b/bypassing_secure_boot_via_unbounded_rle8_splash/: Bypassing Secure Boot via Unbounded RLE8 Splash Images in U-Boot (CVE-2026-71972)
Published Oct 2, 2026
·Updated
Affected Software
1 affected component
DENX U-Boot
Frequently Asked Questions
1
Which devices are realistically exposed to this issue?
Exposure is described for embedded configurations that render an RLE8 BMP boot logo or splash screen through U-Boot before AVB or FIT signature verification. The splash image may be loaded from SPI flash, MMC/eMMC, USB, or an SD card.
2
What access does an attacker need to exploit it?
An attacker needs to be able to provide or modify the RLE8 BMP image that U-Boot loads as its splash screen from the relevant local storage source. The malformed image is processed before the described signature-verification routines run.
3
How can I determine whether a device is in the affected execution path?
Review the U-Boot boot flow to determine whether it displays a BMP splash image, whether that image uses RLE8 encoding, and whether rendering occurs before AVB or FIT verification. Also identify which storage location supplies the splash image and who can modify it.