CVE-2026-74220

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in U-Boot via NFS READ Reply

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: VulnCheck

Description

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-74220

EUVD

EUVD-2026-89433

Affected Vendors & Products

Vendor	Product	Version / Range
denx	uboot	to 2026.10-rc5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-195	The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.

Attack-Flow Graph

Executive Summary

This vulnerability is a buffer overflow in U-Boot versions before 2026.10-rc5. It occurs in the nfs_read_reply() function in net/nfs-common.c. Attackers can exploit it by sending crafted NFS READ reply lengths that bypass length validation due to signed integer handling issues. This allows writing far past the intended buffer, potentially crashing the bootloader or corrupting memory.

Detection Guidance

This vulnerability involves a buffer overflow in U-Boot's NFS handling. Detection requires checking the U-Boot version in use. If your system uses U-Boot before 2026.10-rc5, it may be vulnerable. Check the version with: u-boot-version or strings /path/to/uboot | grep U-Boot. Monitor network traffic for unusual NFS server responses during boot.

Impact Analysis

If exploited, this vulnerability could allow a malicious NFS server to crash the U-Boot bootloader during system startup. This may prevent the device from booting properly, leading to denial of service. Additionally, memory corruption could cause unpredictable behavior or enable further attacks.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by allowing unauthorized memory corruption during the boot process. If exploited, it may lead to system instability or unauthorized code execution, which could compromise data integrity or confidentiality. However, specific compliance impacts depend on system configuration and deployment context.

Mitigation Strategies

Upgrade U-Boot to version 2026.10-rc5 or later. If upgrading is not immediately possible, disable NFS boot functionality or restrict access to trusted NFS servers only. Ensure network segmentation prevents untrusted NFS servers from communicating with vulnerable systems during boot.

Hi! I’m here to help you understand CVE-2026-74220. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70