CVE-2018-18439: Denx U-Boot

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious TFTP server because TFTP traffic is mishandled. Also, local exploitation can occur via a crafted kernel image.

Affected products

• Denx U-Boot: before 2018.09 (fixed in 2018.09); version 2018.09 only

Published 2018-11-20. Last modified 2026-06-17.