Read the docs
TI-2026-52016 Aliases CVE-2026-74220GHSA-63gj-h865-3h3j

U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply

Priority MEDIUM 44CWE-195Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00334 26th percentileScored 2026-11-07
Fix Fixed u-boot (u-boot): 2026.10-rc5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
u-bootu-bootbefore 2026.10-rc52026.10-rc5Patch availableCNA
  • u-boot Vendoru-boot Affected before 2026.10-rc5 Fixed in 2026.10-rc5 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*——u-boot
  • cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:* Versions — — ·u-boot

Remediation

  • Fix · CNA u-boot (u-boot) Fixed in 2026.10-rc5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    u-boot 2026.10-rc5

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-52018 U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive CallbackPriority MEDIUM 44
    • TI-2026-52017 U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINKPriority MEDIUM 44
    • TI-2026-52019 U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6Priority LOW 31
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-74220
  2. 2026-10-03 Alias added: GHSA-63gj-h865-3h3j

References

Patch 1

Other 2

  • TI-2022-02168 Unchecked Download size in Uboot CVSS 3.1HIGH 7.7
  • TI-2025-28794 A lack of signature verification in the bootloader of DENX Software Engineering Das… CVSS 3.1MEDIUM 6.5
  • TI-2020-06770 In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c… CVSS 3.1CRITICAL 9.8
  • TI-2022-12898 nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has… CVSS 3.1CRITICAL 9.8
  • TI-2019-10569 An issue was discovered in Das U-Boot through 2019.07. CVSS 3.0CRITICAL 9.8
  • TI-2019-10568 An issue was discovered in Das U-Boot through 2019.07. CVSS 3.0CRITICAL 9.8
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences