Vulnerability · Published Sep 29, 2026 · Assigned by VulnCheck
CVE-2026-71974U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read
Medium 4.8
In plain English
A medium-severity out-of-bounds write in u-boot from u-boot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.2%top 92.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on devices without Android Verified Boot protection.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | u-boot | no fix listed | UBUNTU-CVE-2026-71974 |
| Ubuntu:24.04:LTS | u-boot | no fix listed | UBUNTU-CVE-2026-71974 |
| Ubuntu:26.04:LTS | u-boot | no fix listed | UBUNTU-CVE-2026-71974 |
| Ubuntu:26.10 | u-boot | no fix listed | UBUNTU-CVE-2026-71974 |
| Ubuntu:22.04:LTS | u-boot-nezha | no fix listed | UBUNTU-CVE-2026-71974 |
| Ubuntu:24.04:LTS | u-boot-nezha | no fix listed | UBUNTU-CVE-2026-71974 |
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
References
- https://github.com/u-boot/u-boot/commit/35432ef6fe2c79ab72709966e64815a45eb55c76 patch
- https://github.com/u-boot/u-boot/blob/v2026.07/boot/bootmeth_android.c#L356 technical-description
- https://patch.msgid.link/20260729-b4-android-bootmeth-oob-v1-1-31c3450ae0be@byteray.co.uk mailing-list
- https://github.com/u-boot/u-boot product
- VulnCheck Advisory: U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read third-party-advisory