U-Boot versions prior to 2026.10-rc5 contain a buffer overflow vulnerability in the nfs_readlink_reply() function when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values, leading to memory corruption and causing the bootloader to crash. This vulnerability has a CVSS score of 8.2, indicating a medium severity impact primarily affecting availability. A patch is available to address this issue.