An integer overflow vulnerability (CWE-190) exists in the ext4fs_read_symlink function of denx U-Boot before version 2025.01-rc1. The issue arises from adding one to a 32-bit little-endian variable representing inode size set to 0xffffffff in a crafted ext4 filesystem, causing the allocation size to wrap around to zero. This leads to a malloc of zero bytes and subsequent memory overwrite, potentially allowing an attacker to compromise system integrity or availability. The vulnerability is remotely exploitable with high attack complexity and no privileges required, as indicated by the CVSS vector (AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

Successful exploitation can lead to memory corruption due to a zero-byte allocation and overwrite, impacting confidentiality, integrity, and availability of the affected system running vulnerable U-Boot versions. The vulnerability is rated high severity with a CVSS score of 7.1. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor denx U-Boot official channels for updates or patches addressing this vulnerability. Until a fix is available, avoid loading untrusted ext4 filesystems in affected U-Boot versions to mitigate risk.