CVE-2026-46728
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability in Das U-Boot before version 2026.04 allows bypassing FIT (Flat Image Tree) signature verification by omitting hashed-nodes from the hash calculation. An attacker can supply a modified FIT image that will be accepted as properly signed.
Risk Assessment
The risk involves the possibility of executing unauthorized, malicious software on devices using U-Boot, potentially leading to system compromise or integrity violation of the boot process.
Recommendation
Immediately update Das U-Boot to version 2026.04 or later, which includes a fix for this vulnerability. In the meantime, restrict access to the FIT image update process.
Original NVD description (English source)
Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.