The vulnerability is a use‑after‑free in the lwIP wget httpc_recv_cb() function. When HTTP data storage fails, the callback frees the connection PCB but returns an incorrect error code, which makes the TCP input path read freed memory and crash the U‑Boot bootloader. This loss of integrity or availability can be triggered by malformed HTTP responses and results in an immediate crash or reboot of the target device.

All versions of the U‑Boot bootloader released before 2026.10‑rc5. Any build derived from a source tree prior to the 2026.10‑rc5 release is vulnerable regardless of target architecture.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog, indicating no known exploitation. The flaw would be exploitable over the network when an attacker can provoke the wget callback by sending a crafted HTTP payload to the bootloader over a TCP connection. Network access to the device’s bootloader interface is required, but no additional credentials are needed.