--- title: New U-Boot flaws could enable stealthy firmware attacks description: Six vulnerabilities have been discovered in U-Boot, one of the world's most widely used open-source bootloaders found in embedded Linux devices, BMCs, IoT... canonical: https://daily.dev/posts/new-u-boot-flaws-could-enable-stealthy-firmware-attacks-306qqf8os twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New U-Boot flaws could enable stealthy firmware attacks | daily.dev og:description: Six vulnerabilities have been discovered in U-Boot, one of the world's most widely used open-source bootloaders found in embedded Linux devices, BMCs, IoT... og:url: https://daily.dev/posts/new-u-boot-flaws-could-enable-stealthy-firmware-attacks-306qqf8os og:image: https://api.daily.dev/og/posts/306QQF8Os.png og:image:alt: New U-Boot flaws could enable stealthy firmware attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New U-Boot flaws could enable stealthy firmware attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 1 upvotes · 0 comments ## Summary Six vulnerabilities have been discovered in U-Boot, one of the world's most widely used open-source bootloaders found in embedded Linux devices, BMCs, IoT devices, and industrial systems. Disclosed by firmware security firm Binarly, the flaws (BRLY-2026-037 through BRLY-2026-042) exist in U-Boot's FIT signature verification code and range from denial-of-service crashes to arbitrary code execution. Two flaws can potentially allow attackers to execute malicious code during firmware verification — before the OS loads — enabling persistent firmware malware installation, disabling security features, or modifying the boot process. The vulnerable code has existed since U-Boot version 2013.07, potentially affecting over 50 stable releases and numerous downstream vendor forks. Exploitation may not require physical access; on BMC-equipped systems, a compromised management interface could allow remote exploitation via crafted firmware images. Patches have been accepted upstream, but distribution depends on individual hardware vendors, and older unsupported devices may never receive fixes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerabilities were found in U-Boot's FIT signature verification code? Six vulnerabilities were disclosed in U-Boot's FIT (Flattened Image Tree) signature verification code, tracked as BRLY-2026-037 through BRLY-2026-042. Two can lead to arbitrary code execution during firmware verification (a crash-and-exploit flaw and a memory corruption bug), while the other four (out-of-bounds read, null pointer dereference, improper validation of external data, and unbounded recursion) can crash the bootloader via denial of service. _Teams hardening embedded and BMC firmware can track bootloader CVEs like these through daily.dev._ ### Which versions of U-Boot are affected by the FIT signature verification vulnerabilities disclosed by Binarly? Most of the vulnerable code has existed since U-Boot version 2013.07, meaning it potentially affects more than 50 stable releases of the project, plus numerous downstream vendor forks used in enterprise BMCs, networking equipment, industrial systems, and IoT devices. Patches for all six issues have been accepted into the upstream codebase, but individual vendors must still integrate them into their firmware updates. _Developers auditing embedded firmware dependencies can follow bootloader patch status via daily.dev._ ### Can U-Boot firmware attacks be exploited remotely without physical access to the device? Yes, on systems such as Baseboard Management Controllers that support remote firmware updates, an attacker who has already compromised the management interface could upload a specially crafted firmware image to trigger the U-Boot FIT signature verification flaws, without needing physical access to the hardware. _Infrastructure teams assessing BMC and firmware attack surfaces can track disclosures like this on daily.dev._ ## Similar posts on daily.dev - [A new unpatchable flaw in Apple chips opens the door to an iPhone jailbreak](https://daily.dev/posts/a-new-unpatchable-flaw-in-apple-chips-opens-the-door-to-an-iphone-jailbreak-qqrtgimnp) · TechCrunch · 0 upvotes · 0 comments - [Thousands of servers can be backdoored by exploiting buggy motherboard controllers](https://daily.dev/posts/thousands-of-servers-can-be-backdoored-by-exploiting-buggy-motherboard-controllers-delcarp96) · Ars Technica · 0 upvotes · 0 comments - [Schneier on Security](https://daily.dev/posts/schneier-on-security-gtentyiez) · Schneier on Security · 2 upvotes · 0 comments --- Tags: [#embedded](https://daily.dev/tags/embedded), [#bootloader](https://daily.dev/tags/bootloader) [View this post on daily.dev](https://daily.dev/posts/new-u-boot-flaws-could-enable-stealthy-firmware-attacks-306qqf8os) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New U-Boot flaws could enable stealthy firmware attacks","url":"https://daily.dev/posts/new-u-boot-flaws-could-enable-stealthy-firmware-attacks-306qqf8os","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-u-boot-flaws-could-enable-stealthy-firmware-attacks-306qqf8os"},"datePublished":"2026-07-11T05:53:58.690Z","dateModified":"2026-09-14T08:27:51.884Z","description":"Six vulnerabilities have been discovered in U-Boot, one of the world's most widely used open-source bootloaders found in embedded Linux devices, BMCs, IoT...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bc9738ed62d9e6949678b0866961084f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bc9738ed62d9e6949678b0866961084f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-u-boot-flaws-could-enable-stealthy-firmware-attacks-306qqf8os","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"embedded,bootloader","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"New U-Boot flaws could enable stealthy firmware attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/new-u-boot-flaws-could-enable-stealthy-firmware-attacks-306qqf8os#faq","mainEntity":[{"@type":"Question","name":"What vulnerabilities were found in U-Boot's FIT signature verification code?","acceptedAnswer":{"@type":"Answer","text":"Six vulnerabilities were disclosed in U-Boot's FIT (Flattened Image Tree) signature verification code, tracked as BRLY-2026-037 through BRLY-2026-042. Two can lead to arbitrary code execution during firmware verification (a crash-and-exploit flaw and a memory corruption bug), while the other four (out-of-bounds read, null pointer dereference, improper validation of external data, and unbounded recursion) can crash the bootloader via denial of service. Teams hardening embedded and BMC firmware can track bootloader CVEs like these through daily.dev."}},{"@type":"Question","name":"Which versions of U-Boot are affected by the FIT signature verification vulnerabilities disclosed by Binarly?","acceptedAnswer":{"@type":"Answer","text":"Most of the vulnerable code has existed since U-Boot version 2013.07, meaning it potentially affects more than 50 stable releases of the project, plus numerous downstream vendor forks used in enterprise BMCs, networking equipment, industrial systems, and IoT devices. Patches for all six issues have been accepted into the upstream codebase, but individual vendors must still integrate them into their firmware updates. Developers auditing embedded firmware dependencies can follow bootloader patch status via daily.dev."}},{"@type":"Question","name":"Can U-Boot firmware attacks be exploited remotely without physical access to the device?","acceptedAnswer":{"@type":"Answer","text":"Yes, on systems such as Baseboard Management Controllers that support remote firmware updates, an attacker who has already compromised the management interface could upload a specially crafted firmware image to trigger the U-Boot FIT signature verification flaws, without needing physical access to the hardware. Infrastructure teams assessing BMC and firmware attack surfaces can track disclosures like this on daily.dev."}}]} ```