U-Boot EUVD-2026-89431

Requires the target device to read and parse an attacker-supplied SquashFS filesystem image via U-Boot's SquashFS support (fs/squashfs/sqfs.c) during or after boot. The attacker must control the SquashFS superblock's metablks_count field, which realistically means placing a crafted image on boot media or a filesystem the bootloader reads - hence the vendor's physical attack vector (AV:P). Limiting factors: exploitation depends on SquashFS support being compiled/enabled and actually invoked against untrusted media, and no network path exists; impact is confined to heap corruption and a bootloader crash (denial of service) rather than confidentiality loss.

This is a genuine-but-bounded memory-corruption flaw whose real-world urgency is limited by its attack vector, not its impact. The vendor CVSS 4.0 vector (AV:P/AC:L/PR:N/UI:N/VC:N/VI:L/VA:H) scores only 5.2 (medium) because exploitation is rated as requiring PHYSICAL access - the crafted SquashFS image must be presented to the bootloader on boot media rather than over a network, which sharply narrows the practical threat model versus U-Boot's network-facing siblings (netboot NFS/DHCP/wget flaws). Technical impact is availability-dominant: the integer overflow (metablks_count × SQFS_METADATA_BLOCK_SIZE) yields a heap under-allocation and subsequent out-of-bounds writes that corrupt the heap and crash the bootloader (VA:H), with only limited integrity impact (VI:L) and no confidentiality loss (VC:N). No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is: no public exploit identified at time of analysis. Signals are internally consistent (low probability, physical vector, DoS-class impact), so this is a legitimate patch-management item rather than an emergency - the medium score is honest, not inflated. The one point to verify: while the vendor asserts AV:P, an attacker who can already write to a mounted filesystem/partition read by U-Boot could trigger this locally (AV:L), so treat the boundary between physical and local as deployment-dependent.

An attacker who can supply boot media or write a filesystem image the bootloader will read (e.g. a malicious USB stick, SD card, or a tampered partition) crafts a SquashFS image with an oversized superblock metablks_count value. When U-Boot parses the directory table, the size multiplication overflows and malloc under-allocates, so the subsequent copy writes out of bounds and corrupts the heap, crashing the bootloader. No public exploit code was identified at the time of analysis.