CVE-2026-46728 — HIGH (8.2)

Q: What is CVE-2026-46728?

CVE-2026-46728 is a vulnerability with a CVSS score of 8.2 (HIGH). Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.

Q: How severe is CVE-2026-46728?

CVE-2026-46728 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-46728?

Check the references section above for vendor advisories and patch information. Affected products include: Denx U-Boot, Pengutronix Barebox.

Vulnerability Description

Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.

CVSS Score

8.2

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Denx	U-Boot	>= 2013.07, <= 2025.10
Pengutronix	Barebox	>= 2016.03.0, < 2025.09.3

Related Weaknesses (CWE)

CWE-346

References

https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4Vendor AdvisoryExploitPatch
https://github.com/u-boot/u-boot/commit/2092322b31cc8b1f8c9e2e238d1043ae0637b241Patch

FAQ

What is CVE-2026-46728?

CVE-2026-46728 is a vulnerability with a CVSS score of 8.2 (HIGH). Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.

How severe is CVE-2026-46728?

CVE-2026-46728 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-46728?

Check the references section above for vendor advisories and patch information. Affected products include: Denx U-Boot, Pengutronix Barebox.