Binarly disclosed six critical U-Boot vulnerabilities (BRLY-2026-037 to 042) in July 2026. Two enable arbitrary code execution before OS load,
The cybersecurity research organization Binarly, specializing in firmware and software supply chain security, formally disclosed in early July 2026 that the open-source bootloader U-Boot contains six critical security vulnerabilities. This set of vulnerabilities has been assigned Binarly-specific identifiers: BRLY-2026-037, BRLY-2026-038, BRLY-2026-039, BRLY-2026-040, BRLY-2026-041, and BRLY-2026-042. According to vulnerability severity classification, BRLY-2026-037 and BRLY-2026-038 could enable attackers to achieve arbitrary code execution; the remaining four vulnerabilities primarily cause denial of service (DoS), leading to system crashes or failure to boot normally [1][2].
After discovering the vulnerabilities, the Binarly team immediately notified the open-source community maintaining U-Boot, and that team developed corresponding patches. After several rounds of review, these patches were successfully merged into the main branch of the U-Boot project. However, cybersecurity news media The Hacker News noted that although U-Boot merged these patches in June, the official July release v2026.07 was frozen in April and thus did not include the patch content [1]. The next release, v2026.10, expected in October, will officially include these fixes, meaning current users must take proactive action to obtain protection [1].
The core threat of these six vulnerabilities lies in the "FIT signature verification mechanism failure," with the critical flaw occurring during U-Boot's verification of digital signatures in Flattened Image Tree (FIT) format [1][3]. U-Boot widely uses FIT format to package multiple image files and relies on digital signature mechanisms to ensure integrity. However, if an attacker places a malicious FIT image before the bootloader, they can trigger memory errors or logical vulnerabilities during the system's Secure Boot digital signature verification [1].
For the two arbitrary code execution vulnerabilities (BRLY-2026-037, BRLY-2026-038), attackers can successfully hijack the control flow and execute malicious code before U-Boot completes security checks. Since the system has not yet entered the operating system layer, attackers gain maximum control over hardware, meaning even if devices enable standard Secure Boot mechanisms, attackers may still seize system control before the OS loads [1]. This attack method directly bypasses Secure Boot's defense logic, rendering traditional preventive measures ineffective.
The remaining four DoS-causing vulnerabilities may trigger memory overflow, null pointer dereference, or resource exhaustion, causing the system to crash at boot. Research indicates such attacks can directly cause service disruption, preventing devices from starting or operating normally [2]. Since the vulnerabilities occur during the verification phase, attackers do not need to crack signatures; constructing a specific malicious image structure alone can trigger errors, significantly lowering the attack threshold.
Since its launch in July 2013, U-Boot has been one of the most widely used bootloaders globally, with over 50 stable versions affected [1][2]. Including numerous downstream vendor branches (downstream forks), the vulnerabilities' impact on the industry is broader and harder to track. Since U-Boot runs on various hardware devices such as home routers, network cameras, and server baseboard management controllers (BMC), the security of related products faces serious risks [1][3].
Specific affected device types include:
Binarly warns that due to U-Boot's high prevalence in embedded environments, these vulnerabilities may not only affect single devices but also spread via supply chain pathways, threatening global infrastructure security [1].
For such high-risk bootloader vulnerabilities, enterprises and technical personnel should immediately implement multi-layered protection measures. First, IT administrators should proactively contact device suppliers (OEM/ODM) to confirm whether firmware patches exist for BRLY-2026-037 through 042 and track supply chain updates [1]. Since official releases do not yet include patches, users must quickly apply patches to their product's main branch version or wait for v2026.10 release [1].
Second, conduct a comprehensive firmware asset inventory, checking U-Boot versions of network devices, server BMCs, and IoT devices deployed internally, especially those using older versions (post-2013) [1]. Additionally, strengthening physical access control is critical; many bootloader attacks require physical interfaces (e.g., Serial Console, USB) or supply chain pathways to inject malicious images. Enhancing server room physical security and device port control is the first line of defense against such attacks [1].
Finally, recommend introducing additional verification layers in system architecture, such as adding hardware-level verification before U-Boot to ensure images are validated during the verification phase, blocking malicious code execution. For devices unable to update immediately, implement network isolation strategies, restricting external connections to reduce attack risk.