U-Boot FIT Parser Flaws Enable Pre-Signature Code Execution Since 2013.07

Binarly disclosed six vulnerabilities (BRLY-2026-037 to 042) in U-Boot's Flattened Image Tree handling. The two highest-impact bugs, present since v2013.07 across more than fifty releases, stem from null pointer and negative length values passed directly into memcpy and pointer arithmetic without validation. Malicious images trigger stack overflows or return-address overwrites at boot time on devices where address zero is mapped.

These issues affect the supply chain at its root: U-Boot underpins routers, IP cameras, and BMC firmware in servers. The same researcher previously demonstrated remote BMC update abuse on Supermicro platforms, showing how an initial foothold can deliver malicious images without physical access. No CVEs were assigned and the v2026.07 release froze before the June upstream patches, leaving downstream vendors to backport manually.

Procurement records and vendor fork counts indicate thousands of untracked deployments. Recovery requires JTAG or chip-off reflashing once persistence is achieved below the OS. The next scheduled release, v2026.10, is the earliest coordinated vector, yet vendor lag will extend exposure well into 2027.