CVE Feed

    Dashboard / CVE / CVE-2026-71973

    CVE-2026-71973

    U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablks_count value that causes heap buffer under-allocation and out-of-bounds writes, corrupting heap memory and crashing the bootloader.

    Published:Sep 29, 2026
    Last Modified:Oct 2, 2026
    EPS:Sep 29, 2026
    EPSS Score:0.00185
    CVSS Score:5.2

    Affected Products

    Vendor
    Denx
    Product
    U-boot
    Vendor
    U-boot
    Product
    U-boot

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-190 Integer Overflow or Wraparound

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2026-74225 (CVSS 7.1) — U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate…
    CVE-2026-74222 (CVSS 8.8) — U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the l…
    CVE-2026-74221 (CVSS 8.8) — U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when…
    CVE-2026-74220 (CVSS 8.8) — U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that all…
    CVE-2026-71974 (CVSS 4.3) — U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails…
    CVE-2026-71972 (CVSS 6) — U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap func…
    CVE-2026-71971 (CVSS 8.8) — U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the _…
    CVE-2025-70293 (CVSS 9.8) — An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ex…
    CVE-2026-29009 (CVSS 8.8) — U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) …
    CVE-2026-29008 (CVSS 8.7) — U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High