AI analysis
U-Boot before 2026.10-rc5 has a use-after-free (CWE-416) in httpc_recv_cb() in the lwIP wget HTTP client. If storing received HTTP data fails, the callback frees the connection protocol control block but returns ERR_BUF instead of ERR_ABRT, so the TCP input path later uses that released memory and crashes the bootloader. An unauthenticated network attacker who can reach a device while it is performing an lwIP HTTP download during boot can cause a boot failure; the CVSS 4.0 score of 8.8 also records low integrity impact, but the description does not establish code execution. Only builds that include this lwIP wget path are affected. The issue is not in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade U-Boot to 2026.10-rc5 or later and confirm that vendor firmware images actually include that fix. Until then, disable or avoid the lwIP wget/HTTP client during boot and do not expose the bootloader network to untrusted hosts or untrusted HTTP content sources.
Affected
| DENX Software Engineering U-Boot | before 2026.10-rc5 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, causing the TCP input path to access released memory and crash the bootloader.