{"id":"CVE-2026-74220","summary":"U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply","details":"U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.","modified":"2026-10-02T08:13:35.352521Z","published":"2026-09-29T21:29:22.617Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-195"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74220.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74220.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74220"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-buffer-overflow-via-nfs-read-reply"},{"type":"FIX","url":"https://github.com/u-boot/u-boot/commit/0bbf09859658b8cc9ac13be41af23b516b8ef69a"},{"type":"PACKAGE","url":"https://github.com/u-boot/u-boot"},{"type":"ARTICLE","url":"https://github.com/u-boot/u-boot/blob/v2026.07/net/nfs-common.c#L695"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/u-boot/u-boot","events":[{"introduced":"0"},{"fixed":"a06e89ab05eaa2b8344d521319399333cd760ae5"},{"fixed":"0bbf09859658b8cc9ac13be41af23b516b8ef69a"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2026.10-rc5"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v2026.07","v2026.10-rc4","v2026.10-rc3","v2026.10-rc2","v2026.10-rc1","v2026.04","v2026.07-rc4","v2026.07-rc5","v2026.07-rc1","v2026.07-rc3","v2026.07-rc2","v2026.04-rc4","v2026.04-rc5","v2026.04-rc3","v2026.04-rc2","v2026.04-rc1","v2026.01-rc4","v2026.01-rc3","v2026.01","v2026.01-rc5","v2026.01-rc2","v2026.01-rc1","v2025.10","v2025.10-rc5","v2025.10-rc4","v2025.10-rc3","v2025.10-rc2","v2025.10-rc1","v2025.07-rc4","v2025.07","v2025.07-rc5","v2025.07-rc3","v2025.07-rc2","v2025.07-rc1","v2025.04-rc4","v2025.04-rc5","v2025.04","v2025.04-rc3","v2025.04-rc2","v2025.04-rc1","v2025.01","v2025.01-rc4","v2025.01-rc6","v2025.01-rc5","v2025.01-rc3","v2025.01-rc2","v2025.01-rc1","v2024.10","v2024.10-rc6","v2024.10-rc4","v2024.10-rc5","v2024.10-rc3","v2024.10-rc2","v2024.10-rc1","v2024.07","v2024.07-rc5","v2024.07-rc4","v2024.07-rc3","v2024.07-rc2","v2024.07-rc1","v2024.04","v2024.04-rc5","v2024.04-rc4","v2024.04-rc3","v2024.04-rc2","v2024.04-rc1","v2024.01-rc5","v2024.01-rc4","v2024.01","v2024.01-rc6","v2024.01-rc3","v2024.01-rc2","v2024.01-rc1","v2023.10","v2023.10-rc4","v2023.10-rc3","v2023.10-rc2","v2023.10-rc1","v2023.07","v2023.07-rc6","v2023.07-rc5","v2023.07-rc4","v2023.07-rc3","v2023.07-rc2","v2023.07-rc1","v2023.04","v2023.04-rc5","v2023.04-rc4","v2023.04-rc3","v2023.04-rc2","v2023.04-rc1","v2023.01","v2023.01-rc4","v2023.01-rc3","v2023.01-rc2","v2023.01-rc1","v2022.10","v2022.10-rc5","v2022.10-rc4","v2022.10-rc3","v2022.10-rc2","v2022.10-rc1","v2022.07","v2022.07-rc6","v2022.07-rc5","v2022.07-rc4","v2022.07-rc3","v2022.07-rc2","v2022.07-rc1","v2022.04","v2022.04-rc5","v2022.04-rc4","v2022.04-rc3","v2022.04-rc2","v2022.04-rc1","v2022.01","v2022.01-rc3","v2022.01-rc4","v2022.01-rc2","v2022.01-rc1","v2021.10","v2021.10-rc5","v2021.10-rc4","v2021.10-rc3","v2021.10-rc2","v2021.10-rc1","v2021.07","v2021.07-rc5","v2021.07-rc4","v2021.07-rc3","v2021.07-rc2","v2021.07-rc1","v2021.04","v2021.04-rc5","v2021.04-rc4","v2021.04-rc3","v2021.04-rc2","v2021.04-rc1","v2021.01","v2021.01-rc4","v2021.01-rc5","v2021.01-rc3","v2021.01-rc2","v2021.01-rc1","v2020.10","v2020.10-rc5","v2020.10-rc4","v2020.10-rc3","v2020.10-rc2","v2020.10-rc1","v2020.07","v2020.07-rc5","v2020.07-rc4","v2020.07-rc3","v2020.07-rc2","v2020.07-rc1","v2020.04","v2020.04-rc5","v2020.04-rc4","v2020.04-rc3","v2020.04-rc2","v2020.04-rc1","v2020.01","v2020.01-rc5","v2020.01-rc4","v2020.01-rc3","v2020.01-rc2","v2020.01-rc1","v2019.10","v2019.10-rc4","v2019.10-rc3","v2019.10-rc2","v2019.10-rc1","v2019.07","v2019.07-rc4","v2019.07-rc3","v2019.07-rc2","v2019.07-rc1","v2019.04","v2019.04-rc4","v2019.04-rc3","v2019.04-rc2","v2019.04-rc1","v2019.01","v2019.01-rc3","v2019.01-rc2","v2019.01-rc1","v2018.11","v2018.11-rc3","v2018.11-rc2","v2018.11-rc1","v2018.09","v2018.09-rc3","v2018.09-rc2","v2018.09-rc1","v2018.07","v2018.07-rc3","v2018.07-rc2","v2018.07-rc1","v2018.05","v2018.05-rc3","v2018.05-rc2","v2018.05-rc1","v2018.03","v2018.03-rc4","v2018.03-rc3","v2018.03-rc2","v2018.03-rc1","v2018.01","v2018.01-rc3","v2018.01-rc2","v2018.01-rc1","v2017.11","v2017.11-rc4","v2017.11-rc3","v2017.11-rc2","v2017.11-rc1","v2017.09","v2017.09-rc4","v2017.09-rc3","v2017.09-rc2","v2017.09-rc1","v2017.07","v2017.07-rc3","v2017.07-rc2","v2017.07-rc1","v2017.05","v2017.05-rc3","v2017.05-rc2","v2017.05-rc1","v2017.03","v2017.03-rc3","v2017.03-rc2","v2017.03-rc1","v2017.01","v2017.01-rc3","v2017.01-rc2","v2017.01-rc1","v2016.11","v2016.11-rc3","v2016.11-rc2","v2016.11-rc1","v2016.09","v2016.09-rc2","v2016.09-rc1","v2016.07","v2016.07-rc3","v2016.07-rc2","v2016.07-rc1","v2016.05","v2016.05-rc3","v2016.05-rc2","v2016.05-rc1","v2016.03","v2016.03-rc3","v2016.03-rc2","v2016.03-rc1","v2016.01","v2016.01-rc4","v2016.01-rc3","v2016.01-rc2","v2016.01-rc1","v2015.10","v2015.10-rc5","v2015.10-rc4","v2015.10-rc3","v2015.10-rc2","v2015.10-rc1","v2015.07","v2015.07-rc3","v2015.07-rc2","v2015.07-rc1","v2015.04","v2015.04-rc5","v2015.04-rc4","v2015.04-rc3","v2015.04-rc2","v2015.04-rc1","v2015.01","v2015.01-rc4","v2015.01-rc3","v2015.01-rc2","v2015.01-rc1","v2014.10","v2014.10-rc3","v2014.10-rc2","v2014.10-rc1","v2014.07","v2014.07-rc4","v2014.07-rc3","v2014.07-rc2","v2014.07-rc1","v2014.04","v2014.01-rc1","v2013.10","v2013.10-rc4","v2013.10-rc3","v2013.10-rc2","v2013.10-rc1","v2013.07","v2013.07-rc3","v2013.07-rc2","v2013.07-rc1","v2013.04","v2013.04-rc3","v2013.04-rc2","v2013.04-rc1","v2013.01","v2013.01-rc3","v2013.01-rc2","v2013.01-rc1","v2012.10","v2012.10-rc3","v2012.10-rc2","v2012.10-rc1","v2012.07","v2012.07-rc3","v2012.07-rc2","v2012.07-rc1","v2012.04.01","v2012.04","v2012.04-rc3","v2012.04-rc2","v2012.04-rc1","v2011.12","v2011.12-rc3","v2011.12-rc2","v2011.12-rc1","v2011.09","v2011.09-rc2","v2011.09-rc1","v2011.06","v2011.06-rc3","v2011.06-rc2","v2011.06-rc1","v2011.03","v2011.03-rc2","v2011.03-rc1","v2010.12","v2010.12-rc3","v2010.12-rc2","v2010.12-rc1","v2010.09","v2010.09-rc1","v2010.06-rc2","v2010.06-rc1","v2010.03","v2010.03-rc3","v2010.03-rc2","v2010.03-rc1","v2009.11","v2009.11-rc2","v2009.11-rc1","v2009.08","v2009.08-rc3","v2009.08-rc2","v2009.08-rc1","v2009.06","v2009.06-rc3","v2009.06-rc2","v2009.06-rc1","v2009.03","v2009.03-rc2","v2009.03-rc1","v2009.01","v2009.01-rc3","v2009.01-rc2","v2009.01-rc1","v2008.10-rc2","v1.3.3","v1.3.3-rc3","v1.3.3-rc2","v1.3.3-rc1","v1.3.2","v1.3.2-rc3","v1.3.2-rc2","v1.3.1","v1.3.1-rc1","U-Boot-1_2_0","U-Boot-1_1_6","LABEL_2006_06_30_2020","U-Boot-1_1_4","LABEL_2006_05_19_1133","LABEL_2006_05_10_1800","LABEL_2006_04_18_1106","LABEL_2005_09_15_2320","U-Boot-1_1_3","LABEL_2005_07_04_0202","LABEL_2005_05_13_0050","LABEL_2005_05_09_1245","LABEL_2005_05_05_1920","LABEL_2005_04_14_0115","LABEL_2005_04_05_2345","LABEL_2005_04_05_1830","LABEL_2005_03_15_0125","LABEL_2005_03_06_0225","LABEL_2005_02_28_0050","LABEL_2005_02_08_1615","LABEL_2005_02_07_2045","LABEL_2005_01_31_2245","U-Boot-1_1_2","LABEL_2004_12_20_1220","LABEL_2004_12_19_2240","LABEL_2004_12_19_1100","LABEL_2004_12_18_2335","LABEL_2004_11_25_0035","LABEL_2004_11_17_2222","LABEL_2004_10_20_0020","LABEL_2004_10_12_0110","LABEL_2004_09_09_0000","LABEL_2004_08_29_0045","LABEL_2004_08_28_2355","LABEL_2004_07_01_1200","LABEL_2004_06_24_1800","LABEL_2004_05_29_1850","LABEL_2004_05_19_2335","U-Boot-1_1_1","LABEL_2004_04_23_2240","LABEL_2004_04_18_2135","U-Boot-1_1_0","LABEL_2004_03_25_1630","LABEL_2004_03_16_2330","LABEL_2004_03_14_2340","LABEL_2004_03_12_0130","LABEL_2004_02_24_0305","LABEL_2004_02_20_2310","U-Boot-1_0_2","LABEL_2004_02_11_2240","LABEL_2004_01_21_2110","LABEL_2004_01_29_1030","U-Boot-1_0_1","LABEL_2003_12_06_1550","LABEL_2003_11_26_MKR","U-Boot-1_0_0","LABEL_2003_10_20_0025","LABEL_2003_10_16_0200","LABEL_2003_10_14_2140","LABEL_2003_10_10_1200","LABEL_2003_10_09_2320","LABEL_2003_10_09_1515","LABEL_2003_10_06_2355","LABEL_2003_10_01_1830","LABEL_2003_09_18_2045","LABEL_2003_09_16_2310","LABEL_2003_09_13_2100","LABEL_2003_09_12_1745","LABEL_2003_09_12_0110","U-Boot-0_4_8","LABEL_2003_09_06_0055","U-Boot-0_4_7","U-Boot-0_4_6","U-Boot-0_4_5","U-Boot-0_4_4","U-Boot-0_4_3","U-Boot-0_4_2","U-Boot-0_4_1","LABEL_2003_06_29_0145","LABEL_2003_06_27_2340","U-Boot-0_4_0","LABEL_2003_06_26_2220","LABEL_2003_06_22_1530","LABEL_2003_06_16_0055","LABEL_2003_06_05_2140","LABEL_2003_06_04_0200","LABEL_2003_05_31_2115","LABEL_2003_05_30_1450","LABEL_2003_05_23_1450","LABEL_2003_05_23_0055","LABEL_2003_05_22_2230","LABEL_2003_05_20_2250","LABEL_2003_05_20_1630","LABEL_2003_05_12_2355","LABEL_2003_05_03_1700","U-Boot-0_3_1","LABEL_2003_04_15_1900","U-Boot-0_3_0","LABEL_2003_04_05_0300","LABEL_2003_03_27_1900","LABEL_2003_03_26_1300","LABEL_2003_03_25_1830","LABEL_2003_03_14_2150","LABEL_2003_03_06_2255","LABEL_2003_03_06_1440","LABEL_2003_03_06_0200","LABEL_2003_03_06_0050","LABEL_2003_02_28_0150","LABEL_2003_01_14_0055","LABEL_2003_01_11_1050","LABEL_2002_12_28_1700","LABEL_2002_12_21_0040","U-Boot-0_2_0","LABEL_2002_12_07_0120","LABEL_2002_12_03_2230","LABEL_2002_11_22_0015","LABEL_2002_11_18_0115","LABEL_2002_11_11_2211","LABEL_2002_11_10_2310","LABEL_2002_11_05_1735","LABEL_2002_11_05_0120"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74220.json","vanir_signatures_modified":"2026-10-02T08:13:35Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/u-boot/u-boot/commit/0bbf09859658b8cc9ac13be41af23b516b8ef69a","target":{"file":"net/nfs-common.c","function":"nfs_read_reply"},"deprecated":false,"digest":{"function_hash":"128626427552653897243693517561781227734","length":1295},"id":"CVE-2026-74220-5b51acf0"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["320793198180052761043446129304245412766","339626875598794819735382856224578102028","256778714225060571425110820085662760996","35698416915743218851232561443195284241","238807569870928325265407972714841281292","69654209686356862874948777599076594643","186164151011140158531701792698463556403","200693821633784765261967198889597850508","234749786293585380748935495222038920691","332145140071611066907260215046973334331","268448813373580851171452236127667946832","119601121266011010546904533141788938645"]},"id":"CVE-2026-74220-fdbaba37","signature_type":"Line","signature_version":"v1","source":"https://github.com/u-boot/u-boot/commit/0bbf09859658b8cc9ac13be41af23b516b8ef69a","target":{"file":"net/nfs-common.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}]}