The vulnerability is an integer overflow in the sqfs_read_directory_table function of U‑Boot. An attacker can craft a SquashFS image with a superblock.metablks_count value that is too large, causing the routine to allocate a buffer that is smaller than required. This under‑allocation leads to out‑of‑bounds writes on the heap, corrupting memory and ultimately causing the bootloader to crash.

Vendor u‑boot, product U‑Boot. All releases prior to the 2026.10‑rc4 tag contain the flaw. No specific sub‑versions are listed, so any build based on an older U‑Boot tag is potentially vulnerable.

The CVSS score of 5.2 indicates a moderate risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The likely attack vector is that an adversary provides a malicious SquashFS image during the boot process. If the device accepts externally supplied images, the exploit could lead to a denial‑of‑service condition by crashing the bootloader. No evidence of remote code execution is present in the given description.