← All advisories

High severity8.2NVD Advisory· Published May 16, 2026· Updated Sep 11, 2026

CVE-2026-46728

CVE-2026-46728

Description

Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5

U Boot/U Bootllm-fuzzy2 versions
<2026.04+ 1 more
- (no CPE)range: <2026.04
- (no CPE)
Barebox/Bareboxllm-fuzzy
Denx/U Boot
cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*
Range: >=2013.07,<=2025.10
Pengutronix/Barebox
cpe:2.3:a:pengutronix:barebox:*:*:*:*:*:*:*:*
Range: >=2016.03.0,<2025.09.3

Patches

Vulnerability mechanics

References

2

github.com/u-boot/u-boot/commit/2092322b31cc8b1f8c9e2e238d1043ae0637b241nvdPatch
github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4nvdExploitPatchVendor Advisory

News mentions

1

Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages
Help Net Security · Sep 14, 2026