CVE-2026-74220: U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply
Vulnerability summary
CVE-2026-74220 is a high (CVSS 8.8) Signed to Unsigned Conversion Error vulnerability in u-boot. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 29-09-2026PublishedVulnerability first disclosed.
- 30-09-2026Last modifiedVulnerability information updated.
Description
U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.
CVSS metrics
7 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- NVDNIST8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu2 products
- u-bootAll versions (No fix recorded) | < 2016.01+dfsg1-2ubuntu5+esm2 | < 2020.10+dfsg-1ubuntu0~18.04.3+esm2 | < 2021.01+dfsg-3ubuntu0~20.04.6+esm2 | < 2022.01+dfsg-2ubuntu2.9 | < 2025.10-0ubuntu0.24.04.4 | < 2025.10-0ubuntu6 | < 2025.10-0ubuntu2.2
- u-boot-nezhaAll versions (No fix recorded)
Debian1 product
- u-bootAll versions (No fix recorded)
U-boot1 product
- u-boot< 2026.10-rc5
3 vendors · 4 products
References
9 links- www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-buffer-overflow-via-nfs-read-replyThird Party AdvisoryREPORT
