CVE-2026-71974 json
U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read
published last mo. modified last mo. also EUVD-2026-89432
- cvss
- 4.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 7%
- public exploits
- 0
- none known
Summary
U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on devices without Android Verified Boot protection.
Patch / fix
Is CVE-2026-71974 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-71974 updated cvss 4.8
uboot-tools: U-Boot: Out-of-bounds write via Android boot partition read
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last mo.
Exploit prediction
0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.3 | CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.8 | CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H |
| CNA | 4.0 | 4.3 | CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- u-boot u-boot
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
github.com
/u-boot/u-boot/commit/35432ef6fe2c79ab72709966e64815a45eb55c76
patch
-
github.com
/u-boot/u-boot/blob/v2026.07/boot/bootmeth_android.c#L356
technical-description
-
patch.msgid.link
/20260729-b4-android-bootmeth-oob-v1-1-31c3450ae0be@byteray.co.uk
mailing-list
-
github.com
/u-boot/u-boot
product
-
vulncheck.com
/advisories/u-boot-before-2026.10-rc3-out-of-bounds-write-via-android-bootmeth-partition-read
third-party-advisory
Sources
- CVE List CVE-2026-71974
- NVD CVE-2026-71974
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.