U-Boot EUVD-2026-89432

Requires physical access to the device to supply crafted boot media (AV:P). Exploitation specifically targets U-Boot's Android boot method: the read_slotted_partition() function in boot/bootmeth_android.c reads an image size from the untrusted Android boot image header without validating it against the partition size, so an oversized header triggers the out-of-bounds write. Exploitation is LIMITED to devices that do NOT have Android Verified Boot (AVB) protection enabled - AVB-protected devices reject the tampered image and are not affected. Only U-Boot versions before 2026.10-rc3 using the Android bootmeth are vulnerable.

This is a genuine low-priority issue despite the OOB-write/memory-corruption classification. The vendor CVSS 4.0 vector (AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H) scoring 4.3 is dominated by the physical attack vector (AV:P) and the attack-requirement (AT:P), both of which sharply constrain real-world exploitability: an attacker must physically supply crafted boot media to the device. There is no EPSS score, no CISA KEV listing, and no public exploit code provided in the intelligence, which is consistent with a physically-gated bootloader flaw that does not lend itself to remote or automated mass exploitation. The impact is honestly capped at partial integrity (VI:L) and high availability (VA:H) - corrupting bootloader memory can brick or destabilize the device, but confidentiality impact is none (VC:N). A further limiting condition is that only devices lacking Android Verified Boot (AVB) protection are affected; AVB-enabled devices are not exploitable. All signals align: low CVSS, no exploitation evidence, physical prerequisite. This is a defense-in-depth hardening fix, not an urgent patch priority, except for threat models that explicitly include evil-maid / supply-chain physical tampering of boot media.

An attacker with physical possession of a device (e.g., evil-maid or a compromised supply chain) crafts boot media containing an Android boot image with an oversized header declaring an image larger than its partition. When U-Boot's read_slotted_partition() loads it without bounds-checking, the read writes past the load buffer into bootloader memory, corrupting execution state. No public exploit code was identified in the provided intelligence; exploitation requires the target device to lack Android Verified Boot protection.