This vulnerability involves integer overflows in the memory allocation logic of denx U-Boot prior to version 2025.01-rc1. Specifically, crafted squashfs filesystems can trigger overflows via the sbrk function, the request2size calculation, or due to incorrect handling of the ptrdiff_t type on x86_64 platforms. These overflows can cause wraparound conditions leading to memory corruption with potential high impact on system confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.1, reflecting high severity with attack vector requiring physical presence (AV:P), high attack complexity, no privileges required, no user interaction, and scope changed. No patch or official remediation guidance is currently documented.

Successful exploitation of this integer overflow can result in memory corruption, potentially allowing an attacker to compromise system confidentiality, integrity, and availability. The vulnerability affects U-Boot bootloader versions before 2025.01-rc1 when processing malicious squashfs filesystems. The CVSS score of 7.1 indicates a high impact, but exploitation requires physical access or local presence due to the attack vector being physical (AV:P). No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should avoid loading untrusted squashfs filesystems in affected U-Boot versions and monitor denx communications for updates. No temporary or official fixes are currently available according to the provided data.