A critical integer overflow vulnerability in Denx U-Boot allows unauthenticated attackers to trigger memory corruption and potential arbitrary code execution during the boot process.

The vulnerability exists within the ZFS filesystem handling logic, where malformed on-disk metadata triggers an integer overflow, leading to incorrect memory allocation and subsequent out-of-bounds access. This flaw is exploitable by an unauthenticated attacker.

The potential for arbitrary code execution during the boot process poses a severe risk to system integrity and security. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it could allow an attacker to gain full control over the affected device before the operating system even initializes.

Immediate Action: Organizations should identify all systems running Denx U-Boot and prepare to update to version 2026.04 or later as soon as the vendor makes the patch available.

Proactive Monitoring: Security teams should monitor device boot logs for anomalous activity or unexpected crashes that may indicate an attempt to exploit the ZFS filesystem parser.

Compensating Controls: Ensure that access to boot configuration and storage media is physically restricted or logically protected to prevent the introduction of malicious filesystem metadata.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the GitHub Gist referenced by the CVE record.

This vulnerability represents a critical threat to hardware and embedded systems that utilize U-Boot with ZFS support. Administrators must prioritize the application of vendor-provided updates immediately upon release, as the ability to execute arbitrary code during the boot cycle provides an attacker with a significant foothold for persistent compromise.