# CVE-2025-24857: Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and…

Source: https://junglewise.ai/threats/cve-2025-24857-improper-access-control-for-volatile-memory-containing-boot-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-10  
License: CC BY 4.0 with a link back

CVE-2025-24857 · Severity: high · CVSS 7.6 · Published 2025-12-10

Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an attacker to execute arbitrary code.

Technologies: [Denx U-Boot](https://junglewise.ai/threats/technologies/u-boot), [Qualcomm Ipq9574](https://junglewise.ai/threats/technologies/ipq9574). Vendors: [Denx](https://junglewise.ai/threats/vendors/denx), [Qualcomm](https://junglewise.ai/threats/vendors/qualcomm).

## Quick answers

**Is CVE-2025-24857 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-24857 being exploited in the wild.

**How severe is CVE-2025-24857?** High severity, with a CVSS score of 7.6, published 10 December 2025.

**Which products and versions are affected?** Denx U-Boot, Qualcomm Ipq4019, Qualcomm Ipq5018, Qualcomm Ipq5322 and 4 more. The advisory does not name versions.

**Is there a fix for CVE-2025-24857?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-24857?** Check whether you run Denx U-Boot, Qualcomm Ipq4019, Qualcomm Ipq5018 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Denx U-Boot
- Qualcomm Ipq4019
- Qualcomm Ipq5018
- Qualcomm Ipq5322
- Qualcomm Ipq6018
- Qualcomm Ipq8064
- Qualcomm Ipq8074
- Qualcomm Ipq9574

## Related threats

- [Denx U-Boot integer overflow in ext4fs_get_bgdtable](https://junglewise.ai/threats/cve-2025-70293-denx-u-boot-integer-overflow-in-ext4fs-get-bgdtable)
- [Denx U-Boot integer overflow in ZFS filesystem support](https://junglewise.ai/threats/cve-2025-70290-denx-u-boot-integer-overflow-in-zfs-filesystem-support)
- [Memory corruption while processing a GP command response.](https://junglewise.ai/threats/cve-2025-27074-memory-corruption-while-processing-a-gp-command-response)
- [Information disclosure while registering commands from clients with diag through diagHal.](https://junglewise.ai/threats/cve-2025-27064-information-disclosure-while-registering-commands-from-clients)
- [Das U-Boot integer overflows in memory allocator](https://junglewise.ai/threats/cve-2024-57258-das-u-boot-integer-overflows-in-memory-allocator)