← ALL ADVISORIES

HIGH BYTERAY-2026-0213Disclosed

U-Boot — Out-of-Bounds Write in the BMP RLE8 Decoder

U-Boot's RLE8 bitmap decoder does not bound its writes to the framebuffer, so a crafted RLE8-compressed BMP decoded during boot writes past the end of the framebuffer and corrupts adjacent memory inside the bootloader.

Advisory
BYTERAY-2026-0213
CVE
CVE-2026-71972
CWE
CWE-787
CVSS
6.0 (CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N); 5.9 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Vendor
U-Boot
Product
U-Boot
Reported
2026-07-29
Disclosure
2026-09-29
Affected
U-Boot through 2026.10-rc5
Fixed in
Commit 5201e83342d64c2f438ea35158575f28225e752e (in u-boot/next; not yet in a tagged release)

Executive Summary

U-Boot decodes a boot logo or splash image during the boot flow. The decoder for RLE8-compressed BMP images does not bound its writes to the framebuffer, so a crafted image writes past the end of it. The logo is commonly loaded from unsigned, attacker-writable storage and decoded before the next boot stage is authenticated, which places an attacker-controlled memory-corruption primitive inside the component that enforces verified boot.

Affected Products and Versions

  • Product: U-Boot, BMP RLE8 decode path in drivers/video/video_bmp.c (video_display_rle8_bitmap()).
  • Affected: U-Boot through 2026.10-rc5.
  • Fixed: commit 5201e83342d64c2f438ea35158575f28225e752e, present in the u-boot/next branch; at the time of writing it is not yet in a tagged release.

Technical Details

video_display_rle8_bitmap() decodes an RLE8-compressed bitmap directly into the framebuffer. It does not bound the decoded run against the framebuffer size, so a crafted RLE8 BMP produces writes past the end of the framebuffer into adjacent memory.

Reachability and Preconditions

  • The device decodes a boot logo or splash BMP during boot.
  • The attacker can place a crafted BMP in the storage U-Boot reads the logo from. This storage is commonly unsigned and attacker-writable, and the decode runs before the next stage is authenticated.

Impact

An out-of-bounds write corrupting memory adjacent to the framebuffer and crashing the bootloader. Because the decode runs inside U-Boot, the verified-boot enforcer, before the next stage is authenticated, the primitive can corrupt the verification logic and bypass secure boot.

Remediation and Mitigation

Update U-Boot to a build containing commit 5201e83342d64c2f438ea35158575f28225e752e (currently in u-boot/next). Where the boot logo is loaded from untrusted storage, restrict write access to that storage until the fix is deployed.

Timeline

  • 2026-07-29 — Vulnerability public and fix available upstream.
  • 2026-07-29 — Fix committed to u-boot/next (commit 5201e83342d64c2f438ea35158575f28225e752e); not yet in a tagged release.
  • 2026-09-29 — CVE-2026-71972 record published by VulnCheck.

Credits

Discovered and reported by Shahriyar Jalayeri and Mehrun P. Hunter of ByteRay Ltd.

References