Six bugs in U-Boot bootloader open the door to hidden firmware attacks

Key points

• Researchers disclosed six vulnerabilities in U-Boot, the open-source bootloader used to start up millions of embedded Linux devices worldwide.
• The flaws sit in code that parses filesystems during boot, letting an attacker with local access run their own code before the operating system loads.
• Successful exploitation can defeat Secure Boot protections and plant malware that survives reinstalls and factory resets.
• Patches landed in the U-Boot project's mainline source in late 2024, but device makers must ship their own firmware updates to customers.
• No active attacks have been reported so far, according to the researchers who found the bugs.

Security researchers have found six flaws in U-Boot, open-source software that starts up vast numbers of embedded devices: home routers, smart TVs, industrial controllers, car infotainment systems and network gear alike.

A bootloader is the very first program that runs when you power on a device. It sets things up, then hands control to the main operating system. Because it runs first, anything malicious hiding inside it runs first too.

The bugs, first reported by BleepingComputer, live in the parts of U-Boot that read filesystems during startup. Filesystems are the way data is organised on a disk or memory chip. Feed U-Boot a booby-trapped one and the parsing code trips over itself in ways an attacker can steer. We covered the initial disclosure of these U-Boot flaws on 10 July 2026.

What could an attacker actually do with this?

Run their own code before the device's normal defences ever wake up. That's the short answer.

An attacker would need local access: a plugged-in USB stick, a swapped SD card, or a tampered storage chip. Once their code runs at the bootloader stage, they can bypass Secure Boot, the check that ensures only trusted software loads at startup. From there, they can install malware that lives below the operating system. Wiping the device doesn't remove it. A factory reset doesn't remove it. Only reflashing the firmware from a clean source does, and most owners never do that.

That's why bootloader bugs matter more than their obscure name suggests. They're the ideal hiding place for spyware and for attacks aimed at specific people or specific organisations.

Which devices are affected?

Any device shipping a vulnerable version of U-Boot, which is a very long list. U-Boot is the default choice for most Linux-based embedded hardware: routers, network storage boxes, smart home hubs, industrial gateways, point-of-sale terminals and automotive systems all lean on it.

The catch is that each manufacturer maintains its own U-Boot build. A fix landing in the upstream project doesn't automatically reach the device on your shelf. Vendors must pull those fixes, build new firmware and ship it. That process routinely takes months. For older or cheaper devices, it often never happens.

Should you worry?

Check for firmware updates from the manufacturer of any embedded gear you rely on, routers and network storage especially. Install them when they appear.

Businesses running industrial or network equipment should ask vendors directly whether their U-Boot builds are patched and get the answer in writing.

Physical access is the main attack path, so keep devices somewhere strangers can't swap storage media or plug in unknown drives. Dull advice, but it matches how these bugs actually get used.

The researchers say they've seen no exploitation in the wild yet. Bootloader flaws tend to surface later, in targeted operations rather than mass campaigns. The absence of noise today isn't the same as safety tomorrow.