CVE-2026-46728CWE-346

CVE-2026-46728

High · published May 17, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
2.6
In the wild
Unconfirmed
What it is

Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00133 · 2.6th percentile
Weakness
CWE-346 · Origin Validation Error
Published
2026-05-17T02:16Z
Affected products (4)
ProductVersionsFixed in
denx/u-boot≥ 2013.07, < 2026.042026.04
denx/u-bootall versions—
denx/u-bootall versions—
denx/u-bootall versions—
References (2)
https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4 · [email protected]https://github.com/u-boot/u-boot/commit/2092322b31cc8b1f8c9e2e238d1043ae0637b241 · [email protected]
EPSS history
Timeline
  • 16 MAY 21:26Z
    Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash
    cvelistv5