Medium severity · published Sep 29, 2026
CVE-2026-71974
U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on devices without Android Verified Boot protection.
CVSS vector
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack vector
Physical
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UB
u-boot · u-boot
before 2026.10-rc3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-71974
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-71974
patch
https://github.com/u-boot/u-boot/commit/35432ef6fe2c79ab72709966e64815a45eb55c76
technical-description
https://github.com/u-boot/u-boot/blob/v2026.07/boot/bootmeth_android.c#L356
mailing-list
https://patch.msgid.link/20260729-b4-android-bootmeth-oob-v1-1-31c3450ae0be@byteray.co.uk
product
https://github.com/u-boot/u-boot
third-party-advisory
https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc3-out-of-bounds-write-via-android-bootmeth-partition-read
More from u-boot
9.8
CVE-2026-29009
U-Boot < 2026.07-rc2 Buffer Overflow in nfs_readlink_reply() via NFS READLINK
8.2
CVE-2026-74222
U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback
8.2
CVE-2026-74221
U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK
8.2
CVE-2026-74220
U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply
8.2
CVE-2026-71971
U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly