CVE-2026-74222

HIGH

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, causing the TCP input path to access released memory and crash the bootloader.

CVSS v3.1 Score

8.2
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
HIGH
Published: 9/29/2026Modified: 10/2/2026

Related Intelligence (1)

HIGHVulnerability

NVD HIGH: CVE-2026-74222 — U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_r...

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, causing the TCP input path to access released memory and crash the bootloader.

CVE-2026-74222
NIST NVD

References (4)

https://github.com/u-boot/u-boothttps://github.com/u-boot/u-boot/blob/v2026.07/net/lwip/wget.c#L194https://github.com/u-boot/u-boot/commit/2d94618a58aeb7630f18eee33419ce48d0fd3616https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-use-after-free-in-lwip-wget-receive-callback