Four U-Boot filesystem overflows risk pre-boot code execution

Four integer overflow flaws in the U-Boot bootloader's filesystem handling can under-allocate heap memory and then overrun it, potentially allowing arbitrary code execution before any operating system starts.

Timo Preißl disclosed the issues, tracked as CVE-2025-70290 through CVE-2025-70293. They affect U-Boot through 2026.01-rc4 and are fixed in 2026.04-rc1.

CVE-2025-70290 is a ZFS metadata flaw: a crafted filesystem image can overflow a size calculation used for allocation, yielding an undersized buffer and out-of-bounds access.

CVE-2025-70291 affects the directory move command. Missing length checks let an attacker with U-Boot shell access overflow string length addition and smash the heap.

CVE-2025-70292 sits in SquashFS token handling. Manipulated token lists overflow a length computation, under-allocating memory that is later overrun.

CVE-2025-70293 covers EXT4 block group descriptor table sizing. An overflow there passes an undersized buffer into a memory copy and corrupts heap state.

U-Boot is the first software after reset on many embedded boards, networking devices, and other systems. Code execution at that stage can undermine secure boot and other controls that assume a trustworthy firmware environment.