CVE-2026-71972

Name of the Vulnerable Software and Affected Versions U-Boot versions prior to 2026.10-rc5

Description An out-of-bounds write exists in the RLE8 bitmap decoder within the video subsystem. The video display rle8 bitmap() function in drivers/video/video bmp.c decodes run-length encoded streams directly into the active framebuffer without validating stream bounds against the frame boundary or allocated buffer size. Because boot splash screens are often rendered from unsigned, user-writable storage before signature verification routines like Android Verified Boot (AVB) or FIT image signature verification are executed, an attacker can provide a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer. This can lead to the corruption of bootloader data structures, function pointers, or verification flags, allowing for a pre-authentication Secure Boot bypass and bootloader crash.

Recommendations Update U-Boot to version 2026.10-rc5 or later. As a temporary mitigation, restrict write access to the storage partitions or external media where boot splash images are stored.