This vulnerability in denx U-Boot prior to version 2026.04 arises from an origin validation error (CWE-346) where the FIT signature verification process is flawed. Specifically, hashed-nodes are omitted from the hash, enabling signature verification bypass. The CVSS 3.1 score is 8.2, reflecting high impact on confidentiality, integrity, and availability, with attack vector local, low attack complexity, and requiring high privileges. The vulnerability affects the bootloader's ability to ensure the authenticity of boot images, potentially allowing malicious code execution during boot.

Successful exploitation could allow an attacker with high privileges to bypass signature verification of boot images, compromising system integrity and potentially enabling execution of unauthorized code during system startup. This impacts confidentiality, integrity, and availability of affected systems. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor denx's advisories for updates. Until a fix is available, restrict access to systems running vulnerable U-Boot versions to trusted administrators only to reduce risk.