CVE-2026-74222

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in U-Boot Bootloader via lwIP HTTP wget

Publication date: 2026-09-29

Last updated on: 2026-10-02

Assigner: VulnCheck

Description

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, causing the TCP input path to access released memory and crash the bootloader.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-74222

EUVD

EUVD-2026-89435

Affected Vendors & Products

Vendor	Product	Version / Range
denx	uboot	to 2026.10-rc5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in U-Boot before version 2026.10-rc5. It occurs in the httpc_recv_cb() function during HTTP data downloads using lwIP. When storage for HTTP data fails, the function incorrectly frees the connection PCB but returns ERR_BUF instead of ERR_ABRT. This causes the TCP input path to access freed memory, leading to a crash of the bootloader.

Detection Guidance

This vulnerability is specific to U-Boot's HTTP wget implementation and may not have direct network detection methods. Focus on checking U-Boot versions and inspecting bootloader logs for crashes during HTTP downloads. No standard commands are provided in the context.

Impact Analysis

This vulnerability can cause system crashes during the boot process if an affected U-Boot version attempts to download data over HTTP. This may result in denial of service, preventing the device from starting properly. Attackers could exploit this to disrupt device functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to a bootloader crash in U-Boot. However, if exploited, it could lead to system instability or denial of service, potentially impacting availability requirements in regulated environments.

Mitigation Strategies

Upgrade U-Boot to version 2026.10-rc5 or later to address the use-after-free vulnerability in the httpc_recv_cb() function.

Hi! I’m here to help you understand CVE-2026-74222. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70