U-Boot CVE-2026-29007

Q: What is the CVSS score of CVE-2026-29007?

CVE-2026-29007 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-42328 MEDIUM

Out-of-bounds Read (CWE-125)

2026-07-08 VulnCheck

GHSA-572m-4pr8-48pj

Buffer Overflow Information Disclosure Red Hat Suse U Boot

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-delivered with no authentication (AV:N/PR:N), but impact is limited to low availability disruption of TCP state; no confirmed confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 17:26 vuln.today

DescriptionCVE.org

U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcp_parse_options() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmt_win_scale and rmt_timestamp to disrupt TCP window calculations.

AnalysisAI

Out-of-bounds read in U-Boot's TCP stack (net/tcp.c, tcp_rx_state_machine()) allows remote unauthenticated attackers to corrupt bootloader TCP connection state by sending a crafted packet with deliberately mismatched IP total length and TCP data offset fields. Affected builds span U-Boot through 2026.04-rc3, but only when compiled with CONFIG_PROT_TCP - a non-default option. Impact is disruption of TCP window calculations via corruption of rmt_win_scale and rmt_timestamp variables, potentially breaking network-based boot sequences. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in CISA KEV.

Technical ContextAI

U-Boot is an open-source bootloader used across a vast range of embedded Linux systems, single-board computers, and IoT devices. The vulnerability is in net/tcp.c within tcp_rx_state_machine(), compiled only when CONFIG_PROT_TCP is set at build time - a non-default feature that enables full TCP/IP stack support in the pre-OS bootloader environment. CWE-125 (Out-of-bounds Read) is the root cause: tcp_parse_options() derives the option data length from the TCP data offset field in the incoming packet without cross-validating it against the actual IP total length. An attacker can craft a packet with an IP total length of 40 bytes while setting the TCP data offset to claim 60 bytes of header, causing the parser to read 40 bytes beyond the actual segment boundary. This overwrites in-memory state variables rmt_win_scale and rmt_timestamp, which govern TCP window scaling and timestamp negotiation - fields critical to reliable TCP session management in TFTP or NFS boot scenarios. CPE cpe:2.3:a:u-boot:u-boot:*:*:*:*:*:*:*:* covers all U-Boot versions.

RemediationAI

Upgrade to a U-Boot release beyond 2026.04-rc3 once an official patched release is tagged; monitor the upstream mailing list at https://lists.denx.de/pipermail/u-boot/2026-May/617853.html for patch availability and the U-Boot project at https://u-boot.org/ for release announcements. No exact patched version has been confirmed in the available references - treat any announced post-rc3 release with a corresponding fix commit as the authoritative patch target. Where immediate upgrade is not feasible, the most direct and complete compensating control is to rebuild U-Boot without CONFIG_PROT_TCP; this eliminates the vulnerable code path entirely but disables TCP networking in the bootloader, which will break TCP-based TFTP or NFS boot workflows if those are in use. As a network-level alternative, restrict which hosts can reach the device's network interface during boot using switch ACLs or firewall rules, preventing untrusted sources from injecting crafted packets during the bootloader phase. Physical network segmentation of PXE or boot VLANs also limits exposure with minimal operational side effects.

More in U Boot

View all

CVE-2022-34835 CRITICAL Act Now POC

9.8 Jun 30

In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md"

CVE-2022-30790 HIGH Act Now POC

7.8 Jun 08

Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552. Rated high severity (CVSS 7.8), this vu

CVE-2020-10648 HIGH Act Now POC

7.8 Mar 19

Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images

CVE-2022-30767 CRITICAL Act Now POC

9.8 May 16

nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a fai

CVE-2018-18439 CRITICAL Act Now POC

9.8 Nov 20

DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious TFTP server because TFTP traf

CVE-2022-2347 HIGH Act Now POC

7.7 Sep 23

There exists an unchecked length field in UBoot. Rated high severity (CVSS 7.7), this vulnerability is no authentication

CVE-2019-14199 CRITICAL Emergency

9.8 Jul 31