Skip to main content

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by… (CVE-2026-74220)

0
High
Published: 09/30/2026 (09/30/2026, 00:32:29 UTC)
Source: GCVE Database

Description

U-Boot versions prior to 2026.10-rc5 contain a buffer overflow vulnerability in the nfs_read_reply() function within net/nfs-common.c. This flaw allows a malicious NFS server to exploit signed integer handling errors to bypass length validation and write beyond the intended buffer, potentially crashing the bootloader or corrupting memory.

CVSS v3.1

Score 8.2high

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected software

GitHub Actionsmore threats →ai
u-boot/u-boot
pkg:github/u-boot/u-boot
Affected versions
<2026.10-rc5

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 09/30/2026, 01:06:15 UTC

Technical Analysis

The vulnerability identified as CVE-2026-74220 affects U-Boot before version 2026.10-rc5. It is a buffer overflow in the nfs_read_reply() function caused by improper handling of signed integers in NFS READ reply lengths. An attacker controlling a malicious NFS server can craft reply lengths that bypass validation checks, leading to memory corruption or bootloader crashes.

Potential Impact

Exploitation of this vulnerability can result in memory corruption or denial of service due to bootloader crashes. The integrity of the boot process may be compromised, potentially affecting system availability. There is no indication of confidentiality or direct code execution impact in the provided data.

Mitigation Recommendations

A fix is available in U-Boot version 2026.10-rc5. Users should upgrade to this version or later to remediate the vulnerability. No additional mitigation guidance is provided or necessary beyond applying the official patch.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Osv Id
GHSA-63gj-h865-3h3j
Osv Schema Version
1.4.0
Aliases
["CVE-2026-74220"]
Database Specific Severity
HIGH
Cvss Version
3.1

Threat ID: 6abc5d46680226ef6899ba76

Added to database: 09/30/2026, 00:52:22 UTC

Last enriched: 09/30/2026, 01:06:15 UTC

Last updated: 09/30/2026, 01:06:27 UTC

Views: 3

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses