U‑Boot versions before 2026.04 contain a flaw in the Flat Image Tree (FIT) signature verification path where the list of hashed‑nodes is omitted from the hash computation. This weakness, classified as CWE‑346, allows an attacker to craft a malicious FIT image that still passes signature validation. By loading such a forged image, an adversary could execute arbitrary code with the privileges of the bootloader or operating system, effectively taking control of the device.

Denx U‑Boot deployments older than 2026.04 are impacted. The vulnerability affects every U‑Boot build that supports FIT images for firmware updates or booting, regardless of the underlying hardware platform. No specific device models are cited, so any system using an unpatched U‑Boot source tree that uses FIT images should be considered at risk.

The CVSS v3 score of 8.2 indicates a high severity, while the EPSS score is unavailable and the vulnerability is not listed in CISA's KEV catalog, leaving exploitation likelihood uncertain. Based on the description, the likely attack vector is an adversary who can modify the firmware media or supply a custom FIT image to the target. Once the signature check is bypassed, the attacker can gain full control, compromising confidentiality, integrity, and availability of the device. The risk assessment suggests a substantial threat, particularly in environments where firmware authenticity cannot be guaranteed.