PT-2026-81209

CVE-2026-74220

Published

2026-08-25

Updated

2026-11-04

Description by

CVSS 4.0

8.8

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions U-Boot versions prior to 2026.10-rc5

Description A buffer overflow exists in the nfs read reply() function within the net/nfs-common.c file. A malicious NFS server can exploit signed integer handling to bypass length validation by providing crafted NFS READ reply lengths. This allows the attacker to write data far beyond the destination buffer, which can lead to memory corruption or a bootloader crash.

Recommendations Update to version 2026.10-rc5 or later.

Exploitability

Exploit

Fix

Researchers

Shahriyar Jalayeri

Vendors

Affected products

Weakness enumeration

CWE-195: Signed to Unsigned Conversion Error

Related identifiers

CVE-2026-74220