U-Boot versions prior to 2026.10-rc3 contain an out-of-bounds write vulnerability in the read_slotted_partition() function. This occurs because the image size is not properly validated against partition bounds, allowing crafted boot media with oversized headers to cause memory corruption. The vulnerability affects devices without Android Verified Boot protection and requires physical access to exploit. The CVSS score is 4.8, indicating medium severity.