CVE-2026-71973: U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation

Vulnerability summary

CVE-2026-71973 is a medium (CVSS 5.2) Integer Overflow or Wraparound vulnerability in u-boot. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.7% of scored vulnerabilities.

Timeline

1. 29-09-2026
   PublishedVulnerability first disclosed.
2. 02-10-2026
   Last modifiedVulnerability information updated.

Description

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablks_count value that causes heap buffer under-allocation and out-of-bounds writes, corrupting heap memory and crashing the bootloader.

• CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.