U-Boot versions prior to 2026.10-rc4 contain an integer overflow vulnerability in the sqfs_read_directory_table() function. This flaw occurs when processing a crafted SquashFS image with a malicious superblock metablks_count value, leading to heap buffer under-allocation and out-of-bounds writes. The vulnerability can cause heap memory corruption and bootloader crashes. The CVSS 3.1 base score is 5.2, indicating medium severity. No known exploits are reported in the wild. Affected versions include many specific Ubuntu package versions and all versions before 2026.10-rc4.