Read the docs
TI-2026-50268 Aliases CVE-2026-71974GHSA-c7vr-vjm2-3grc

U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read

Priority LOW 19CWE-787Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on devices without Android Verified Boot protection.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00177 7th percentileScored 2026-11-07
Fix Fixed u-boot (u-boot): 2026.10-rc3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
u-bootu-bootbefore 2026.10-rc32026.10-rc3Patch availableCNA
  • u-boot Vendoru-boot Affected before 2026.10-rc3 Fixed in 2026.10-rc3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*——u-boot
  • cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:* Versions — — ·u-boot

Remediation

  • Fix · CNA u-boot (u-boot) Fixed in 2026.10-rc3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    u-boot 2026.10-rc3

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-50265 U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment ReassemblyPriority MEDIUM 44
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-71974
  2. 2026-10-03 Alias added: GHSA-c7vr-vjm2-3grc

References

Patch 1

Other 3

  • TI-2022-02168 Unchecked Download size in Uboot CVSS 3.1HIGH 7.7
  • TI-2025-28794 A lack of signature verification in the bootloader of DENX Software Engineering Das… CVSS 3.1MEDIUM 6.5
  • TI-2020-06770 In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c… CVSS 3.1CRITICAL 9.8
  • TI-2022-12898 nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has… CVSS 3.1CRITICAL 9.8
  • TI-2019-10569 An issue was discovered in Das U-Boot through 2019.07. CVSS 3.0CRITICAL 9.8
  • TI-2019-10568 An issue was discovered in Das U-Boot through 2019.07. CVSS 3.0CRITICAL 9.8
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences