How severe is CVE-2026-74221?

CVE-2026-74221 has a CVSS 3.x base score of 8.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability high.

Is CVE-2026-74221 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (26th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-74221?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-74221 published?

CVE-2026-74221 was published on 2026-09-29 and last updated on 2026-09-30.

CVE-2026-74221

CVE-2026-74221 is a high-severity vulnerability with a CVSS 3.x base score of 8.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-195.

Key facts

Severity: High (CVSS 3.x base score 8.2)
CVSS v4: 8.8
EPSS exploit prediction: 0% (26th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-195
Published: 2026-09-29
Last modified: 2026-09-30

Description

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.

Frequently asked questions

What is CVE-2026-74221?: U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.
How severe is CVE-2026-74221?: CVE-2026-74221 has a CVSS 3.x base score of 8.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability high.
Is CVE-2026-74221 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (26th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-74221?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-74221 published?: CVE-2026-74221 was published on 2026-09-29 and last updated on 2026-09-30.

References

Other CWE-195 vulnerabilities

CVE-2026-17507 — High (CVSS 8.7): In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index…
CVE-2024-25388 — High (CVSS 8.4): drivers/wlan/wlan_mgmt,c in RT-Thread through 5.0.2 has an integer signedness error and resultant buffer overflow.
CVE-2026-74220 — High (CVSS 8.2): U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows…
CVE-2026-77406 — High (CVSS 8.2): RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative…
CVE-2020-6096 — High (CVSS 8.1): An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000.…
CVE-2026-85441 — High (CVSS 7.5): MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in…

Browse all CWE-195 vulnerabilities →