CVE-2026-71972 — U-Boot through 2026.10-rc5 Out-of-Bounds Write in BMP RLE8 Decoder
U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. Attackers can supply a crafted R…
Published: 2026-09-29 · CVSS: 6.0 · CVSS 4.0
U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7