PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46728 denx CVE debrief

CVE-2026-46728 is a high-severity U-Boot issue affecting FIT (Flat Image Tree) signature verification in versions before 2026.04. The supplied record says hashed-nodes is omitted from a hash, which can allow a verification bypass and weaken the integrity of signed boot images. Because this sits in the boot trust path, it deserves prompt review in any deployment that relies on U-Boot FIT signatures.

Vendor
denx
Product
U-Boot
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-16
Original CVE updated
2026-09-11
Advisory published
2026-05-16
Advisory updated
2026-09-11

Who should care

Embedded firmware teams, bootloader maintainers, device manufacturers, and operators of systems that rely on U-Boot FIT signature verification for secure or verified boot.

Technical summary

The CVE record describes a FIT signature verification bypass in U-Boot before 2026.04 caused by hashed-nodes being omitted from a hash. That means the data covered by the verification step is incomplete, creating an opportunity to bypass the intended signature check. NVD lists the weakness as CWE-346 and assigns CVSS v3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating local access with high privileges and potentially broad impact once the flaw is reachable.

Defensive priority

High. A signature verification bypass in the boot chain can undermine firmware trust assumptions and should be prioritized for inventorying, patching, and validation across affected devices.

Recommended defensive actions

  • Identify whether any products, builds, or device fleets use U-Boot versions before 2026.04 with FIT signature verification enabled.
  • Upgrade to U-Boot 2026.04 or later, or apply the upstream fix referenced by the CVE record.
  • Rebuild and redeploy firmware images after patching so signed artifacts are validated by the corrected logic.
  • Review secure-boot, attestation, and integrity-monitoring assumptions for systems that depend on U-Boot FIT verification.
  • Track impacted embedded platforms and coordinate maintenance windows for firmware rollout and validation.

Evidence notes

The source corpus explicitly states that U-Boot before 2026.04 allows a FIT signature verification bypass because hashed-nodes is omitted from a hash. NVD metadata for the same record provides CVSS v3.1 vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H and CWE-346. The provided references also include a U-Boot upstream commit and a related barebox security advisory, but the direct technical basis used here is the CVE/NVD record plus the referenced upstream fix link.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46728 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46728

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46728 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46728

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.