CVE-2026-74220CWE-195

CVE-2026-74220

High · published September 30, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
EPSS
0.00338 · 26.1th percentile
Weakness
CWE-195 · Signed to Unsigned Conversion Error
Published
2026-09-30T02:18Z
References (4)
https://github.com/u-boot/u-boot · [email protected]https://github.com/u-boot/u-boot/blob/v2026.07/net/nfs-common.c#L695 · [email protected]https://github.com/u-boot/u-boot/commit/0bbf09859658b8cc9ac13be41af23b516b8ef69a · [email protected]https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-buffer-overflow-via-nfs-read-reply · [email protected]
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 0%
    epss
  • 29 SEP 21:29Z
    U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply
    cvelistv5