PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-13104 Siemens CVE debrief

CVE-2019-13104 is a high-severity memory corruption issue in Das U-Boot's ext4 filesystem handling. According to the CVE description, an underflow can cause memcpy() to overwrite a very large amount of data, including the whole stack, when reading a crafted ext4 filesystem. NVD rates the issue 7.8 HIGH with local access and user interaction required, so the main risk is to devices that parse untrusted storage or boot media during startup.

Vendor
Siemens
Product
RUGGEDCOM ROX MX5000
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

Firmware and embedded Linux teams shipping U-Boot, OEMs and device vendors that boot from removable or externally sourced storage, downstream distro maintainers, and security teams responsible for embedded systems that may parse ext4 filesystems during boot.

Technical summary

The vulnerability is described as an underflow in U-Boot's ext4 path that can make memcpy() overwrite a very large amount of data, including the stack, while reading a crafted ext4 filesystem. NVD classifies the weakness as CWE-191 and CWE-787 and assigns CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The published affected-version metadata spans multiple U-Boot 2016.09-2019.04 builds and 2019.07 release candidates/releases.

Defensive priority

High priority for any environment that boots from, mounts, or otherwise parses ext4 content from media that may not be trusted or fully controlled.

Recommended defensive actions

  • Upgrade U-Boot to a build that includes the upstream/vendor fix referenced in the DENX mailing list patch thread.
  • Inventory affected devices and firmware images against the NVD/CVE version ranges, including U-Boot 2016.09-2019.04 and 2019.07 release-candidate/release entries, and confirm any downstream backports.
  • Treat removable media, disk images, and other ext4 sources as untrusted until patched devices are verified.
  • Apply downstream vendor or distro advisories relevant to your platform, including openSUSE and Siemens references if those products are in your fleet.
  • Validate boot paths after remediation to ensure the firmware update did not break startup or storage parsing.
  • Reduce exposure to unknown boot media or operator-supplied filesystem images where practical, since the CVSS vector requires local access and user interaction.

Evidence notes

The supplied CVE description states that an underflow in Das U-Boot can cause memcpy() to overwrite a very large amount of data, including the whole stack, when reading a crafted ext4 filesystem. NVD records CVSS 7.8 HIGH, CWE-191 and CWE-787, and vulnerable CPE criteria covering multiple U-Boot versions plus downstream openSUSE entries. The DENX mailing list reference is the primary vendor patch/advisory pointer, while the openSUSE and Siemens advisories corroborate downstream impact and remediation activity.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-13104 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-13104

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-13104 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-13104

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-16.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-577017.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-577017.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-16

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.