Das U-Boot from v2020.10 to v2022.07-rc3 exists to contain an out-of-bounds write via the function sqfs_readdir().
denx u-boot 2022.07
denx u-boot