Use-After-Free Vulnerability in U-Boot Bootloader by Denx Software Engineering
CVE-2026-74222

8.8HIGH

Key Information:

Vendor

U-boot

Status
U-boot
Vendor
CVE Published:
29 September 2026

What is CVE-2026-74222?

A use-after-free vulnerability exists in the httpc_recv_cb() function within the lwIP wget implementation of U-Boot, prior to version 2026.10-rc5. This flaw occurs when HTTP data storage fails, causing the callback to free the connection PCB but incorrectly returning ERR_BUF instead of ERR_ABRT. This can lead to the TCP input path attempting to access memory that has already been released, which may result in a crash of the bootloader, thereby compromising system integrity.

Affected Version(s)

u-boot 0 < 2026.10-rc5

References

https://github.com/u-boot/u-boot/commit/2d94618a58aeb7630...
patch
https://github.com/u-boot/u-boot/blob/v2026.07/net/lwip/w...
technical-description
https://github.com/u-boot/u-boot
product

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shahriyar Jalayeri (ByteRay Ltd.)
Mehrun P. Hunter (ByteRay Ltd.)
.