CVE-2026-46728: denx u-boot Origin Validation Error
Analyzed
AliasesUBUNTU-CVE-2026-46728DEBIAN-CVE-2026-46728
Published 16-05-2026Last modified 18-05-2026
Vulnerability summary
CVE-2026-46728 is a high (CVSS 8.8) Origin Validation Error vulnerability in denx u-boot. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.5% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
0.13%
0%100%
Low · -0.08 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github
Timeline
- 16-05-2026PublishedVulnerability first disclosed.
- 18-05-2026Last modifiedVulnerability information updated.
Description
Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.
CVSS metrics
4 scores · 4 sources · 1 versionHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSources4 sources · 8.2–8.8
- CVE.orgCNA8.2HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
Decrease -0.08 pp
From 0.21% on 22-09-2026
22-09-202622-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundBarebox
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Ubuntu2 products
- u-bootAll versions (No fix recorded)
- u-boot-nezhaAll versions (No fix recorded)
Debian1 product
- u-boot< 2023.01+dfsg-2+deb12u3 | < 2025.01-3+deb13u1 | < 2025.01-3.2
Denx1 product
- u-boot< 2026.04 | ≥ 2013.07, < 2026.04 | 2026.04:rc1 | 2026.04:rc2 | 2026.04:rc3
3 vendors · 4 products
