CVE Feed

    Dashboard / CVE / CVE-2026-74220

    CVE-2026-74220

    U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.

    Published:Sep 29, 2026
    Last Modified:Sep 30, 2026
    EPS:Sep 29, 2026
    EPSS Score:0.00338
    CVSS Score:8.2

    Affected Products

    Vendor
    Denx
    Product
    U-boot

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-74225 (CVSS 7.1) — U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate…
    CVE-2026-74222 (CVSS 8.8) — U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the l…
    CVE-2026-74221 (CVSS 8.8) — U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when…
    CVE-2026-71974 (CVSS 4.3) — U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails…
    CVE-2026-71973 (CVSS 5.2) — U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() function w…
    CVE-2026-71972 (CVSS 6) — U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap func…
    CVE-2026-71971 (CVSS 8.8) — U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the _…
    CVE-2025-70293 (CVSS 9.8) — An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ex…
    CVE-2026-29009 (CVSS 8.8) — U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) …
    CVE-2026-29008 (CVSS 8.7) — U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High