Malicious firmware can hijack the device before Linux is launched and remain almost invisible to security programs. Binarly researchers have discovered six vulnerabilities in the U-Boot bootload, which uses routers, server equipment, industrial systems, and many IoT devices.
U-Boot is launched one of the first after the device is turned on, prepares the equipment and transmits control of the operating system. Error at this level allows the attacker to interfere in the loading before the antivirus, surveillance means and other protective mechanisms.
The problems were found in the code for verifying digital signatures of FIT images, or Flattened Image Tree. U-Boot uses the FIT format to pack the Linux kernel, configuration and other firmware components. The Verified Boot mechanism should check the signature and reject the modified image, however, the vulnerable code begins to disassemble the contents of the file before the authentication is completed. A specially prepared image is therefore able to cause a failure or damage the memory even before the downloader recognizes the signature as invalid.
Two vulnerabilities allow under certain conditions to perform arbitrary code in the context of the bootloader. Four more result in denial of service and can make the device unloaded. Errors are associated with stack damage, reading data outside the permissible memory area, changing the zero pointer, insufficient displacement check and unlimited recursion.
The most dangerous vulnerability BRLY-2026-038 was scored 6.8 points out of 10 on the CVSS scale. The error causes exit beyond the lower buffer stack when checking the signature. The researchers believe that the attacker can overwriting the official data and achieve the execution of the code before the operation system is launched. The vulnerability of BRLY-2026-037 usually completes the bootloader, but with a suitable memory configuration, it can also lead to the execution of the code.
A successful attack gives the attacker control at an early stage of loading. Malicious code will be able to change the order of starting components, disable individual security checks or install the implant in the firmware. Conventional protections within the operating system have difficulty detecting such threats, as they receive management later.
For operation, it is required to transfer the device a prepared form of firmware. In many scenarios, the attacker will need physical access or control over the update system. However, local presence is not always required. BMC server control controllers and some network devices support a remote firmware update. After hacking the administrative interface, the attacker will be able to download the malicious image through the network.
Most of the vulnerable code appeared in U-Boot 2013.07. According to Binarly, the problems can affect more than 50 stable releases, as well as numerous versions that equipment manufacturers have changed and included in their own firmware. The exact list of devices is not yet missing due to the huge number of independent U-Boot assemblies.
The researchers reported errors to U-Boot developers in May 2026. Corrections have already been added to the main code of the project, but it is not enough for users to update the downloader yourself. Manufacturers of routers, servers and embedded devices should include patches in their firmware and release updates. Older models without support may remain vulnerable forever.
U-Boot is launched one of the first after the device is turned on, prepares the equipment and transmits control of the operating system. Error at this level allows the attacker to interfere in the loading before the antivirus, surveillance means and other protective mechanisms.
The problems were found in the code for verifying digital signatures of FIT images, or Flattened Image Tree. U-Boot uses the FIT format to pack the Linux kernel, configuration and other firmware components. The Verified Boot mechanism should check the signature and reject the modified image, however, the vulnerable code begins to disassemble the contents of the file before the authentication is completed. A specially prepared image is therefore able to cause a failure or damage the memory even before the downloader recognizes the signature as invalid.
Two vulnerabilities allow under certain conditions to perform arbitrary code in the context of the bootloader. Four more result in denial of service and can make the device unloaded. Errors are associated with stack damage, reading data outside the permissible memory area, changing the zero pointer, insufficient displacement check and unlimited recursion.
The most dangerous vulnerability BRLY-2026-038 was scored 6.8 points out of 10 on the CVSS scale. The error causes exit beyond the lower buffer stack when checking the signature. The researchers believe that the attacker can overwriting the official data and achieve the execution of the code before the operation system is launched. The vulnerability of BRLY-2026-037 usually completes the bootloader, but with a suitable memory configuration, it can also lead to the execution of the code.
A successful attack gives the attacker control at an early stage of loading. Malicious code will be able to change the order of starting components, disable individual security checks or install the implant in the firmware. Conventional protections within the operating system have difficulty detecting such threats, as they receive management later.
For operation, it is required to transfer the device a prepared form of firmware. In many scenarios, the attacker will need physical access or control over the update system. However, local presence is not always required. BMC server control controllers and some network devices support a remote firmware update. After hacking the administrative interface, the attacker will be able to download the malicious image through the network.
Most of the vulnerable code appeared in U-Boot 2013.07. According to Binarly, the problems can affect more than 50 stable releases, as well as numerous versions that equipment manufacturers have changed and included in their own firmware. The exact list of devices is not yet missing due to the huge number of independent U-Boot assemblies.
The researchers reported errors to U-Boot developers in May 2026. Corrections have already been added to the main code of the project, but it is not enough for users to update the downloader yourself. Manufacturers of routers, servers and embedded devices should include patches in their firmware and release updates. Older models without support may remain vulnerable forever.
