PatchSiren cyber security CVE debrief
CVE-2026-46728 Unknown Vendor CVE debrief
CVE-2026-46728 is a high-severity U-Boot issue affecting FIT (Flat Image Tree) signature verification in versions before 2026.04. The supplied record says hashed-nodes is omitted from a hash, which can allow a verification bypass and weaken the integrity of signed boot images. Because this sits in the boot trust path, it deserves prompt review in any deployment that relies on U-Boot FIT signatures.
- Vendor
- Unknown Vendor
- Product
- Unknown
- CVSS
- HIGH 8.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-16
- Original CVE updated
- 2026-05-16
- Advisory published
- 2026-05-16
- Advisory updated
- 2026-05-16
Who should care
Embedded firmware teams, bootloader maintainers, device manufacturers, and operators of systems that rely on U-Boot FIT signature verification for secure or verified boot.
Technical summary
The CVE record describes a FIT signature verification bypass in U-Boot before 2026.04 caused by hashed-nodes being omitted from a hash. That means the data covered by the verification step is incomplete, creating an opportunity to bypass the intended signature check. NVD lists the weakness as CWE-346 and assigns CVSS v3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating local access with high privileges and potentially broad impact once the flaw is reachable.
Defensive priority
High. A signature verification bypass in the boot chain can undermine firmware trust assumptions and should be prioritized for inventorying, patching, and validation across affected devices.
Recommended defensive actions
- Identify whether any products, builds, or device fleets use U-Boot versions before 2026.04 with FIT signature verification enabled.
- Upgrade to U-Boot 2026.04 or later, or apply the upstream fix referenced by the CVE record.
- Rebuild and redeploy firmware images after patching so signed artifacts are validated by the corrected logic.
- Review secure-boot, attestation, and integrity-monitoring assumptions for systems that depend on U-Boot FIT verification.
- Track impacted embedded platforms and coordinate maintenance windows for firmware rollout and validation.
Evidence notes
The source corpus explicitly states that U-Boot before 2026.04 allows a FIT signature verification bypass because hashed-nodes is omitted from a hash. NVD metadata for the same record provides CVSS v3.1 vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H and CWE-346. The provided references also include a U-Boot upstream commit and a related barebox security advisory, but the direct technical basis used here is the CVE/NVD record plus the referenced upstream fix link.
Official resources
Disclosed in the supplied CVE/NVD record on 2026-05-16T22:16:13.317Z; the published and modified timestamps in the provided data are identical.