CVE-2025-70293

EUVD-2025-210792
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy() which could lead to arbitrary code execution, a denial of service, or other unspecified impacts.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 55.94%
Debian logo
Debian Releases
Debian Product
Codename
u-boot
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
u-boot
bionic
Fixed 2020.10+dfsg-1ubuntu0~18.04.3+esm1
released
focal
Fixed 2021.01+dfsg-3ubuntu0~20.04.6+esm1
released
jammy
Fixed 2022.01+dfsg-2ubuntu2.8
released
noble
Fixed 2025.10-0ubuntu0.24.04.3
released
resolute
Fixed 2025.10-0ubuntu2.1
released
xenial
not-affected
u-boot-nezha
jammy
needs-triage
noble
needs-triage
resolute
dne
Common Weakness Enumeration
References
http://denx.com
http://u-boot.com
https://gist.github.com/c0zy1/4d9648d10a5ff07bda2771ea1298e469