CVE-2019-13104: Denx U-Boot

High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days.

In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to overwrite a very large amount of data (including the whole stack) while reading a crafted ext4 filesystem.

Affected products

• Denx U-Boot: from 2016.09, up to and including 2019.04; version 2019.07 only
• Opensuse Leap: version 15.0 only; version 15.1 only

Published 2019-08-06. Last modified 2026-06-17.