CyberRota Analysis
AI-GeneratedA buffer overflow vulnerability in the nfs_read_reply() function of U-Boot allows attackers to exploit crafted NFS READ reply lengths, potentially leading to memory corruption or bootloader crashes. This issue arises from improper signed integer handling, enabling malicious NFS servers to bypass length validation. Organizations using U-Boot in their embedded systems should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.