CVE-2025-70290 Integer overflow in n/a
An integer overflow in U-Boot's ZFS support allows attackers to trigger out-of-bounds memory access, potentially leading to arbitrary code execution or crashes during boot.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-70290?
CVE-2025-70290 is a critical vulnerability in n/a, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.
Which versions are affected by CVE-2025-70290?
How do I fix CVE-2025-70290?
Upgrade to a fixed version.
Is CVE-2025-70290 being exploited?
There is no known exploitation of CVE-2025-70290 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-70290, GHSA-j2xx-grh4-4p3q, UBUNTU-CVE-2025-70290.