CVE-2025-24857

⚠️ high

Summary

Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an attacker to execute arbitrary code.

CVSS Score

7.6

High

EPSS Score

0.0

Exploit Probability

Published Date

2025-12-10

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 68.2% of all 365,890 vulnerabilities in our database.

#116,477

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Dec 11, 2025

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2026-01-21

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-284

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
denx	u-boot	Affected	< 2017.11

🔗 References 1

https://www.cisa.gov/news-events/ics-advisories/icsa...

Third Party Advisory US Government Resource

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-29007	🔶 medium	5.3	0.6	U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFI...	2026-07-08
CVE-2026-29008	⚠️ high	7.5	0.6	U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c...	2026-07-08
CVE-2026-29009	⚠️ high	8.2	0.6	U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFI...	2026-07-08
CVE-2026-46728	⚠️ high	8.2	0.2	Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted fro...	2026-05-16
CVE-2026-33243	⚠️ high	8.2	0.1	barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport t...	2026-03-20
CVE-2025-45512	🔶 medium	6.5	0.1	A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attack...	2025-08-05

These CVEs affect the same products