VulnSocial

CVE-2026-46728Disclosure(denx / u-boot)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.

denx CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-346

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • u-boot

Threat summary

  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-05-16); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
denx
Products
u-boot

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-05-16: 1Mentions · 2026-05-17: 1Mentions · 2026-07-12: 1Technical Details · 2026-05-16: 1Technical Details · 2026-05-17: 105-1605-1707-12
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-05-161
Disclosure1
2026-05-171
Disclosure1
2026-07-121
General1
Full discourse3 posts
  • GizanTech@GizanTech4IR
    General

    U-Boot FIT signature vuln (CVE-2026-46728) is a serious one. Stealthy firmware attacks are a major worry for embedded Linux. It's why we hammer on secure boot & flash encryption for #ESP32. What's your go-to defense for boot chain integrity? 🛡️ https://t.co/jrqzMUR0FX

    Post summary

    The tweet flags CVE-2026-46728 as a serious U‑Boot FIT signature issue, urging secure boot and flash encryption for ESP32, but provides no technical details, patches, or evidence of exploitation.

    1000045
    9 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-46728 Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash. https://www.cve.org/CVERecord?id=CVE-2026-46728

    Post summary

    The message announces a signature verification bypass in U‑Boot prior to 2026.04, offering basic technical details but no PoC, exploit code, or mitigation advice.

    00000195
    57.5K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-46728 FIT Signature Verification Bypass in Das U-Boot Before 2026.04 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-46728

    Post summary

    The message announces CVE-2026-46728 as a FIT signature verification bypass in Das U-Boot prior to version 2026.04, without offering a PoC, exploit, patch, or evidence of active exploitation.

    0000067
    4.0K followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
Appdenxu-boot---
Appdenxu-boot2026.04--
Appdenxu-boot2026.04--
Appdenxu-boot2026.04--

Explore more

Back to dashboarddenx CVEsu-boot vulnerabilities