CVE-2025-70290

EUVD-2025-210793
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 50.76%
Debian logo
Debian Releases
Debian Product
Codename
u-boot
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
u-boot
bionic
Fixed 2020.10+dfsg-1ubuntu0~18.04.3+esm1
released
focal
Fixed 2021.01+dfsg-3ubuntu0~20.04.6+esm1
released
jammy
Fixed 2022.01+dfsg-2ubuntu2.8
released
noble
Fixed 2025.10-0ubuntu0.24.04.3
released
resolute
Fixed 2025.10-0ubuntu2.1
released
xenial
Fixed 2016.01+dfsg1-2ubuntu5+esm1
released
u-boot-nezha
jammy
needs-triage
noble
needs-triage
resolute
dne
Common Weakness Enumeration
References
http://u-boot.com
https://gist.github.com/c0zy1/4d9648d10a5ff07bda2771ea1298e469