U-Boot before 2026.10-rc5 contains a buffer overflow in the function that processes NFS READ replies. The overflow is caused by signed integer handling that bypasses length validation, allowing an attacker to write beyond the bounds of the destination buffer. If successful, the exploit can crash the bootloader or corrupt memory, which may lead to unintended behavior or compromise of the system during startup.

All installations of U-Boot older than version 2026.10-rc5, including releases such as v2026.07 and earlier, are affected. This affects any device that uses the U-Boot bootloader and communicates with an NFS server during boot.

The CVSS score of 8.8 indicates a high severity vulnerability. The vulnerability is exploitable through a malicious NFS server, so the attacker must control or compromise an NFS server that the target device contacts during boot. The EPSS score is not available and it is not listed in CISA’s KEV catalog, so the likelihood of immediate exploitation in the wild may be lower, but the potential impact remains significant. The flaw provides an attacker the ability to corrupt memory during a critical boot phase, posing a serious risk to confidentiality, integrity, and availability.