CVE Feed

    Dashboard / CVE / CVE-2026-74222

    CVE-2026-74222

    U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, causing the TCP input path to access released memory and crash the bootloader.

    Published:Sep 29, 2026
    Last Modified:Oct 2, 2026
    EPS:Sep 29, 2026
    EPSS Score:0.00303
    CVSS Score:8.2

    Affected Products

    Vendor
    Denx
    Product
    U-boot
    Vendor
    U-boot
    Product
    U-boot

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-416 Use After Free

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-74225 (CVSS 7.1) — U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate…
    CVE-2026-74221 (CVSS 8.8) — U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when…
    CVE-2026-74220 (CVSS 8.8) — U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that all…
    CVE-2026-71974 (CVSS 4.3) — U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails…
    CVE-2026-71973 (CVSS 5.2) — U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() function w…
    CVE-2026-71972 (CVSS 6) — U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap func…
    CVE-2026-71971 (CVSS 8.8) — U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the _…
    CVE-2025-70293 (CVSS 9.8) — An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ex…
    CVE-2026-29009 (CVSS 8.8) — U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) …
    CVE-2026-29008 (CVSS 8.7) — U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High