CVE-2022-33967: Denx U-Boot

High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days.

squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.

Affected products

• Denx U-Boot: version 2020.10 only; version 2021.01 only; version 2021.04 only; version 2022.01 only; version 2022.04 only; version 2022.07 only

Published 2022-07-20. Last modified 2026-06-17.