Firmware researchers at Binarly disclosed six new vulnerabilities in U-Boot, the small program that boots hardware as varied as home routers, IP cameras, and the management controllers inside data center servers, and the flaws sit in the exact code meant to stop an untrusted boot image from running in the first place.
Binarly’s research, tracked under advisories BRLY-2026-037 through BRLY-2026-042, targets U-Boot’s FIT (Flattened Image Tree) signature verification, the mechanism that checks a boot image is authentic before the device trusts it. Two of the six flaws enable arbitrary code execution and four cause denial of service, including a null pointer dereference in the routine that locates regions inside a boot image and an unbounded recursion bug during FIT format validation. Every flaw triggers while U-Boot is still parsing the untrusted image, before signature validation completes, so a malicious image does not need to pass any authenticity check to cause harm. Binarly found that most of the vulnerable code has existed since U-Boot version 2013.07, shipping in more than 50 subsequent releases across any vendor that built firmware on top of it.
The significance is structural, not just technical: a verified boot vulnerability defeats the one promise verified boot exists to make, that a device will refuse to run firmware it cannot authenticate. Because U-Boot ships embedded inside device firmware rather than as an application a security team patches directly, remediation depends on individual OEMs shipping new firmware, a slower supply chain than enterprise software patching. CyberTech has covered this gap before: CERT/CC’s disclosure of a hardcoded backdoor in Tenda router firmware with no available patch showed the same pattern. Teams with a mature application patch cadence often have no equivalent inventory of what bootloader code runs inside their routers, cameras, and server management hardware, which is exactly where flaws like these six persist for over a decade before anyone looks.
Source: Binarly
