Which versions of U-Boot are affected by CVE-2026-74220?

A memory corruption vulnerability in the U-Boot bootloader's NFS client (CVE-2026-74220, CVSS 8.8) exposes organizations that use NFS netboot to unauthenticated attackers on the boot network,…. A patch is available.

How to fix or mitigate CVE-2026-74220?

Within 24 hours, inventory all U-Boot-based devices configured for NFS netboot and isolate or restrict boot networks to trusted NFS servers; verify that NFS servers are not compromised or spoofable. Within 7 days, apply the vendor-released patch by upgrading to U-Boot 2026.10-rc5 or later (or backport commit 0bbf0985) on representative devices, then validate boot functionality in a test environment. Within 30 days, complete fleet-wide deployment of the patched U-Boot version, update configuration management and firmware baselines, and enforce network segmentation between boot networks and untrusted networks.

U-Boot CVE-2026-74220

Q: What is the CVSS score of CVE-2026-74220?

CVE-2026-74220 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-89433 HIGH

Signed to Unsigned Conversion Error (CWE-195)

2026-09-29 VulnCheck

GHSA-63gj-h865-3h3j

Buffer Overflow Suse U Boot

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Attacker-controlled/MITM NFS server reaches the client unauthenticated with no user interaction (AV:N/AC:L/PR:N/UI:N); dominant impact is bootloader crash (A:H) with limited memory corruption (I:L) and no data disclosure (C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 29, 2026 - 22:07 vuln.today

CVE Published

Sep 29, 2026 - 21:29 cve.org

HIGH 8.8

DescriptionCVE.org

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.

AnalysisAI

Memory corruption in the U-Boot bootloader's NFS client lets a malicious or man-in-the-middle NFS server overflow the packet buffer in nfs_read_reply(), crashing the bootloader or corrupting memory before control is handed to the kernel. Affected are U-Boot builds prior to 2026.10-rc5 that perform NFS netboot (CPE cpe:2.3:a:u-boot:u-boot:*); the flaw is reachable by an unauthenticated network attacker (CVSS vector PR:N), though per our assessment the practical outcome is a boot-time denial of service with limited integrity impact rather than confirmed code execution, since the device must be actively NFS-booting and the attacker must control or intercept the NFS server on the boot network. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires the target device to be performing NFS netboot (U-Boot NFS transfer active), and the attacker must control the NFS server the device reads from or be able to MITM the unauthenticated NFS traffic on the boot network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine memory-corruption flaw but its real-world priority is bounded by a narrow trigger, not the raw 8.8 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary fix is to upgrade U-Boot to 2026.10-rc5 or later, which includes commit 0bbf09859658b8cc9ac13be41af23b516b8ef69a (https://github.com/u-boot/u-boot/commit/0bbf09859658b8cc9ac13be41af23b516b8ef69a); vendors maintaining downstream firmware should backport that commit, as changing the signed rlen to u32 and enforcing rlen <= NFS_READ_SIZE plus an explicit data_offset bounds check is a small, self-contained change with no functional side effects. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all U-Boot-based devices configured for NFS netboot and isolate or restrict boot networks to trusted NFS servers; verify that NFS servers are not compromised or spoofable. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in U Boot

View all

CVE-2022-34835 CRITICAL Act Now POC

9.8 Jun 30

In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md"

CVE-2022-30790 HIGH Act Now POC

7.8 Jun 08

Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552. Rated high severity (CVSS 7.8), this vu

CVE-2020-10648 HIGH Act Now POC

7.8 Mar 19

Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images

CVE-2022-30767 CRITICAL Act Now POC

9.8 May 16

nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a fai

CVE-2018-18439 CRITICAL Act Now POC

9.8 Nov 20

DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious TFTP server because TFTP traf

CVE-2022-2347 HIGH Act Now POC

7.7 Sep 23

There exists an unchecked length field in UBoot. Rated high severity (CVSS 7.7), this vulnerability is no authentication

CVE-2019-14199 CRITICAL Emergency

9.8 Jul 31