PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46728 Unknown Vendor CVE debrief

CVE-2026-46728 is a high-severity U-Boot issue affecting FIT (Flat Image Tree) signature verification in versions before 2026.04. The supplied record says hashed-nodes is omitted from a hash, which can allow a verification bypass and weaken the integrity of signed boot images. Because this sits in the boot trust path, it deserves prompt review in any deployment that relies on U-Boot FIT signatures.

Vendor
Unknown Vendor
Product
Unknown
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-16
Original CVE updated
2026-05-16
Advisory published
2026-05-16
Advisory updated
2026-05-16

Who should care

Embedded firmware teams, bootloader maintainers, device manufacturers, and operators of systems that rely on U-Boot FIT signature verification for secure or verified boot.

Technical summary

The CVE record describes a FIT signature verification bypass in U-Boot before 2026.04 caused by hashed-nodes being omitted from a hash. That means the data covered by the verification step is incomplete, creating an opportunity to bypass the intended signature check. NVD lists the weakness as CWE-346 and assigns CVSS v3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating local access with high privileges and potentially broad impact once the flaw is reachable.

Defensive priority

High. A signature verification bypass in the boot chain can undermine firmware trust assumptions and should be prioritized for inventorying, patching, and validation across affected devices.

Recommended defensive actions

  • Identify whether any products, builds, or device fleets use U-Boot versions before 2026.04 with FIT signature verification enabled.
  • Upgrade to U-Boot 2026.04 or later, or apply the upstream fix referenced by the CVE record.
  • Rebuild and redeploy firmware images after patching so signed artifacts are validated by the corrected logic.
  • Review secure-boot, attestation, and integrity-monitoring assumptions for systems that depend on U-Boot FIT verification.
  • Track impacted embedded platforms and coordinate maintenance windows for firmware rollout and validation.

Evidence notes

The source corpus explicitly states that U-Boot before 2026.04 allows a FIT signature verification bypass because hashed-nodes is omitted from a hash. NVD metadata for the same record provides CVSS v3.1 vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H and CWE-346. The provided references also include a U-Boot upstream commit and a related barebox security advisory, but the direct technical basis used here is the CVE/NVD record plus the referenced upstream fix link.

Official resources

Disclosed in the supplied CVE/NVD record on 2026-05-16T22:16:13.317Z; the published and modified timestamps in the provided data are identical.