What is the CVSS score of CVE-2025-70290?

CVE-2025-70290 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of U-Boot are affected by CVE-2025-70290?

Das U-Boot bootloader contains a critical memory corruption vulnerability in its ZFS driver that could cause boot failures or allow code execution at startup on affected systems.

How to fix or mitigate CVE-2025-70290?

Within 24 hours: Audit systems inventory to identify all deployed instances of U-Boot before version 2026.04, especially those with ZFS support enabled in data center or edge computing environments. Within 7 days: Implement access controls restricting physical and logical access to ZFS storage devices; disable ZFS support in U-Boot configurations if operationally feasible; activate bootloader security features including Secure Boot or TPM verification. Within 30 days: Monitor vendor advisories for U-Boot version 2026.04 release; once available, develop a deployment plan, validate in non-production environments, and stage upgrades across production systems in risk-prioritized order, focusing first on systems with high physical access risk or critical operational impact.

U-Boot CVE-2025-70290

EUVD-2025-210793 CRITICAL

Integer Overflow or Wraparound (CWE-190)

2026-08-26 mitre

GHSA-j2xx-grh4-4p3q

Integer Overflow RCE N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.4 HIGH

Trigger is malformed on-disk ZFS metadata parsed at boot, so AV:L not AV:N; no auth or prior privilege needed (PR:N) and full code-execution impact gives C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 27, 2026 - 22:32 vuln.today

CVSS changed

Aug 27, 2026 - 20:37 NVD

9.8 (CRITICAL)

CVE Published

Aug 26, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Aug 26, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.

AnalysisAI

Memory corruption in Das U-Boot's ZFS filesystem driver (all releases before 2026.04) lets an attacker who controls the on-disk ZFS metadata trigger an integer overflow (CWE-190) that leads to undersized allocation and out-of-bounds access, enabling a boot-time crash or arbitrary code execution in the pre-OS bootloader context. Rated CVSS 9.8 by the reporter, but the flaw is reached only when U-Boot parses attacker-supplied ZFS storage during boot, so realistic exploitation is local/physical rather than network-borne. EPSS is low (0.17%, 7th percentile) and there is no confirmed active exploitation.

Technical ContextAI

U-Boot is the dominant open-source bootloader for embedded and IoT systems; it can mount several filesystems (ext4, FAT, ZFS, etc.) to load kernel and boot images. The vulnerability lives in the optional ZFS support, where fields from on-disk ZFS metadata are used in size arithmetic without adequate bounds checking. Per CWE-190 (Integer Overflow or Wraparound), a crafted metadata value overflows during a size computation, so a subsequent allocation is too small; later reads/writes then run past the buffer (out-of-bounds access), corrupting adjacent memory in the bootloader's flat, largely unprotected execution environment. The CPE (cpe:2.3:a:n/a:n/a:*) is a placeholder and provides no usable product/version constraint.

RemediationAI

Vendor-released patch: upgrade to U-Boot 2026.04 or later, which contains the fix; rebuild and reflash device firmware and re-sign boot images as required by your secure-boot chain. Where immediate upgrade is not possible, the most effective compensating control is to disable ZFS filesystem support in the U-Boot build configuration (drop CONFIG_FS_ZFS / ZFS command support) if the device does not need to boot from ZFS - this removes the vulnerable code path entirely, at the cost of losing ZFS boot capability. Additionally, restrict the boot order so devices boot only from trusted, non-removable, integrity-protected storage and disallow booting from user-attachable ZFS media (trade-off: reduces recovery/USB-boot flexibility), and enforce signed-image verification before ZFS parsing where the platform allows. Confirm the exact fixed version and any backports against the official U-Boot release notes; the http://u-boot.com reference in the feed is unverified, so validate advisories via denx.de or the U-Boot GitLab.