A newly disclosed six vulnerabilities in U-Boot, one of the most widely deployed bootloaders in embedded systems, routers, IoT devices, and Baseboard Management Controllers (BMCs) used in data center servers.
The flaws reside in the FIT (Flattened Image Tree) Signature Verification logic, a core mechanism that underpins U-Boot’s Verified Boot feature and Root of Trust (RoT) protections.
Since U-Boot executes early in the boot chain, vulnerabilities here can undermine every subsequent stage of firmware execution.
Multiple U-Boot FIT Signature Flaws
Binarly’s analysis, based on U-Boot v2026.04, found that most of the affected code has existed since v2013.07, meaning over 50 stable releases, plus countless vendor forks, are potentially impacted.
Of the six flaws, two enable arbitrary code execution, while four cause denial-of-service (DoS) attacks.
BRLY-2026-037 is a null pointer dereference in the function fdt_find_regions, triggered when fdt_get_name returns NULL during FIT parsing; depending on memory layout, this can escalate from a simple crash to a stack-based buffer overflow if chained with control over address 0x0.
BRLY-2026-038 is a stack buffer underflow in the same function, where a negative error code returned in place of a length value causes a pointer to move backward, eventually overwriting the return address and enabling full code execution, as demonstrated on QEMU ARM.
BRLY-2026-039 causes a DoS via an unvalidated size field in the “hashed-strings” property, allowing attackers to force U-Boot to read up to 4GB beyond the image bounds.
BRLY-2026-040 is a null pointer dereference that occurs when parsing FDT properties on images with outdated version headers.
BRLY-2026-041 stems from unchecked external data offset and size fields, which let attackers point hash verification at out-of-bounds memory or request massive read sizes.
Finally, BRLY-2026-042 involves unbounded recursion in fdt_check_no_at during format validation; because each nested node costs just 12 bytes of image size but consumes 16 or more bytes of stack per recursive call, attackers can reliably exhaust the stack regardless of available device RAM.
All six flaws trigger during processing of untrusted FIT images, before validation completes, meaning a malicious image doesn’t even need to pass authenticity checks to cause harm.
While exploitation is often assumed to require physical access, Binarly’s prior research on Supermicro BMCs showed that remote attackers can sometimes exploit firmware update mechanisms to deliver malicious images without directly touching the hardware.
The consequences vary by flaw type. DoS bugs can effectively brick a device, sometimes requiring physical SPI reflashing to recover, while code execution flaws are far more dangerous, allowing attackers to run malicious code at the very earliest stage of boot.
This makes any resulting implant extremely stealthy and difficult to detect through conventional means.
Binarly reported the issues under U-Boot’s security policy, and after an initially rocky disclosure process, worked directly with maintainers Simon Glass and Tom Rini to develop and merge patches into the U-Boot master branch.
All fixes are now publicly available, and affected vendors and device manufacturers are urged to apply them promptly.
Binarly plans a follow-up post detailing how it integrated U-Boot analysis into its Transparency Platform and VulHunt API to detect these classes of bugs at scale going forward.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
