What’s Vulnerable › Vulnerabilities

CVE-2026-46728

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-16 · updated 2026-10-26
• Weakness: CWE-346

Description

Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.

Affected products

• u-boot: from 2013.07 before 2026.04; 2026.04-rc1, 2026.04-rc2, 2026.04-rc3 — fixed in 2026.04

How to fix

Upgrade to a fixed version: u-boot 2026.04. Check the vendor advisory for mitigations.

References

• https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4
• https://github.com/u-boot/u-boot/commit/2092322b31cc8b1f8c9e2e238d1043ae0637b241

Get alerted when CVE-2026-46728 or the next vulnerability affects your stack