An out‑of‑bounds write occurs in U‑Boot’s read_slotted_partition() function because the code does not validate the image size against the partition bounds. When boot media contains an oversized header, the function writes past the load buffer into the bootloader’s memory. This corruption can compromise the integrity of the bootloader and potentially allow malicious modifications to the boot process.

The vulnerability is present in all releases of U‑Boot before version 2026.10‑rc3. Devices that ship with the affected bootloader, particularly those that do not enable Android Verified Boot, are susceptible when booting from external media that could be tampered with.

The CVSS base score is 4.3, indicating a low severity rating. EPSS data is not available, so the current probability of exploitation is unclear. Because the attack requires physical access to supply a crafted boot medium and is not listed in the CISA KEV catalog, the real‑world risk is limited, though the failure can severely undermine boot integrity if an attacker succeeds.