New U-Boot Flaws Could Enable Stealthy Firmware Attacks
What happened
Binarly researchers disclosed six vulnerabilities in U-Boot, a widely used open-source bootloader found in embedded Linux devices, enterprise server Baseboard Management Controllers, networking equipment, industrial systems, IoT devices, and other appliances. The flaws affect U-Boot’s FIT signature verification code, which is used to validate firmware and operating system images before they are loaded.
Two of the vulnerabilities can potentially allow arbitrary code execution during firmware verification, while the other four can crash vulnerable devices. The flaws are tracked as BRLY-2026-037 through BRLY-2026-042 and include memory corruption, out-of-bounds read, null pointer dereference, improper validation of externally stored firmware data, and unbounded recursion issues.
The vulnerable code has existed since U-Boot version 2013.07, meaning the issues may affect more than 50 stable U-Boot releases and many downstream vendor firmware forks. If exploited, attackers could execute code during the earliest stages of the boot process, before the operating system and endpoint security tools load.
Binarly warned that exploitation could allow attackers to disable firmware security features, modify the boot process, install persistent firmware malware, or perform other pre-OS actions that are difficult to detect. Physical access is not always required. On devices such as BMCs that support remote firmware updates, an attacker who already compromised the management interface could upload a malicious firmware image to trigger exploitation.
Binarly reported the vulnerabilities to U-Boot maintainers and submitted patches for all six issues, which have been accepted upstream. However, because hardware vendors integrate U-Boot into their own firmware, customers will need vendor firmware updates before the fixes reach affected devices. Older or unsupported devices may never receive patches.
Who is affected
Organizations using embedded Linux devices, BMCs, networking equipment, industrial systems, IoT devices, and appliances that rely on vulnerable U-Boot versions may be affected.
The risk is highest for systems that allow remote firmware updates, expose management interfaces, or run vendor firmware that includes affected U-Boot code.
Hardware vendors, OEMs, and device manufacturers are also affected because they must incorporate upstream U-Boot fixes into their own firmware builds before customers can remediate.
Why CISOs should care
This issue matters because bootloaders sit below the operating system. If attackers compromise the boot process, they may be able to persist in ways that normal endpoint tools cannot see or remove.
For CISOs, BMC exposure is especially important. A compromised management interface could become a path to upload malicious firmware and exploit the bootloader before the server operating system starts.
The downstream patching problem also raises operational risk. Even though U-Boot patches have been accepted upstream, enterprise remediation depends on each hardware vendor shipping updated firmware for specific devices.
The long-lived nature of the vulnerable code means exposure may be broad and uneven. Some devices may be patchable quickly, while older embedded systems, industrial devices, or unsupported appliances may require compensating controls or replacement.
3 practical actions
Inventory devices that use U-Boot: Security teams should identify embedded Linux appliances, BMCs, networking gear, industrial systems, and IoT devices that may include U-Boot in their firmware stack.
Track vendor firmware updates: CISOs should ask vendors whether their products are affected by BRLY-2026-037 through BRLY-2026-042 and when patched firmware will be available.
Restrict firmware update and management access: Until patches are available, organizations should lock down BMCs and device management interfaces, require trusted administrative paths, monitor firmware update activity, and investigate unexpected bootloader or firmware changes.
Cybersecurity in the news:
AssuranceAmerica Data Breach Exposes Records of 6.9 Million Drivers
Banana RAT Uses Exposed Payload Generator to Create Polymorphic Banking Malware
Fake Paysafe and Skrill SDKs on npm and PyPI Steal Developer Credentials
Hackers Exploit Roundcube Flaw to Spy on Academic Researchers
APT-C-20 Hides Shellcode in PNG Images for Fileless Espionage Attack