An integer overflow in the ext4fs_get_bgdtable function causes the code to under‑allocate a buffer. The under‑allocated buffer is then used in a memcpy call, which can lead the attacker to execute arbitrary code, cause a denial of service, or produce other adverse effects. The vulnerability is triggered solely by the size calculation and does not rely on input the attacker controls directly, but the corrupted buffer presents an exploitable memory corruption flaw.

Denx U‑Boot firmware prior to the 2026.04 release is affected. The exact affected versions are all releases before 2026.04; no specific vendor or product variants are listed beyond the generic U‑Boot designation.

The CVSS score is 9.8, and the EPSS score is less than 1%, indicating a high severity flaw but a low publicly reported exploitation probability. Nonetheless, because the flaw permits arbitrary code execution and could be triggered during the boot process via malicious ext4 filesystem data, the potential impact is severe. The attack likely requires the ability to influence the bootloader’s handling of ext4 filesystems, such as by booting from compromised media or injecting payloads into a target device’s storage. The flaw does not appear in the CISA KEV catalog, suggesting no confirmed exploitation has been reported yet, but the risk remains high due to the nature of bootloader vulnerabilities.