What is the CVSS score of CVE-2024-57259?

CVE-2024-57259 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of U Boot are affected by CVE-2024-57259?

Organizations using Das U-Boot face moderate risk from CVE-2024-57259 rated CVSS 7.1. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2024-57259?

Within 7 days: Identify all affected systems running Das U-Boot and apply vendor patches promptly. Vendor patch is available.

U Boot CVE-2024-57259

HIGH

Off-by-one Error (CWE-193)

2025-02-18 cve@mitre.org

Buffer Overflow Suse U Boot Denx

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Physical

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:27 vuln.today

Patch released

Mar 28, 2026 - 18:27 nvd

Patch available

CVE Published

Feb 18, 2025 - 23:15 nvd

HIGH 7.1

DescriptionCVE.org

sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-193. sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation. Affected products include: Denx U-Boot. Version information: before 2025.01.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in U Boot

View all

CVE-2022-34835 CRITICAL Act Now POC

9.8 Jun 30

In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md"

CVE-2022-30790 HIGH Act Now POC

7.8 Jun 08

Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552. Rated high severity (CVSS 7.8), this vu

CVE-2020-10648 HIGH Act Now POC

7.8 Mar 19

Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images

CVE-2022-30767 CRITICAL Act Now POC

9.8 May 16

nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a fai

CVE-2018-18439 CRITICAL Act Now POC

9.8 Nov 20

DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious TFTP server because TFTP traf

CVE-2022-2347 HIGH Act Now POC

7.7 Sep 23

There exists an unchecked length field in UBoot. Rated high severity (CVSS 7.7), this vulnerability is no authentication

CVE-2019-14199 CRITICAL Emergency

9.8 Jul 31