U-Boot versions prior to 2026.10-rc5 contain a buffer overflow vulnerability in the nfs_read_reply() function. This flaw arises from signed integer handling errors that allow a malicious NFS server to bypass length validation and write beyond the intended buffer, potentially causing memory corruption or bootloader crashes. The vulnerability has a CVSS score of 8.2, indicating a medium severity level. A patch is available to address this issue.