CVE-2026-74222: U-Boot

High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days.

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, causing the TCP input path to access released memory and crash the bootloader.

Affected products

• U-Boot U-Boot: before 2026.10-rc5 (fixed in 2026.10-rc5)

Published 2026-09-29. Last modified 2026-10-02.