CVE-2019-13104: In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to overwrite a very...

Security readout for executives and security teams

This issue affects Das U-Boot bootloader versions 2016.11-rc1 through 2019.07-rc4. A malicious ext4 filesystem could trigger a memory underflow while U-Boot reads it, potentially corrupting the bootloader stack. Business risk is highest for embedded or appliance systems that boot from writable, removable, or attacker-influenced storage. Exposure is likely limited to systems using affected U-Boot versions and reading ext4 filesystems during boot or recovery. Internet-facing exposure is not supported by the provided sources. Physical access, supply-chain tampering, service access, or writable boot media would materially increase risk. Prioritize asset discovery first. This is not shown as actively exploited in the provided sources, but bootloader memory corruption can be serious for embedded estates, especially where attackers can access or modify boot storage. Mitigation focus: Inventory products and firmware builds for affected U-Boot versions.; Check vendor advisories for fixed firmware or supported update paths.; Restrict physical and administrative access to boot media..

Prepared

Jun 6, 2026, 13:47 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.