CVE-2022-33967 squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified in Das U-Boot Affecting SquashFS and Ext4 Filesystems Six vulnerabilities have been identified in Das U-Boot, affecting its handling of squashfs and ext4 filesystems. These include integer overflows and stack consumption issues that could lead to memory overwrites and other critical failures. The vulnerabilities are associated with CVE-2024-57254, CVE-2024-57255, CVE-2024-57256, CVE-2024-57257, CVE-2024-57258, and CVE-2024-57259, all published on February 18, 2025. 9 sources 49

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

MITRE ATT&CK (1)

T1203 - Exploitation for Client Execution

Platforms (2)

SquashFS U-Boot