CVE-2026-74222 — U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback…
Published: 2026-09-29 · CVSS: 8.8 · CVSS 4.0
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, causing the TCP input path to access released memory and crash the bootloader.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7