CVE-2026-74220, CVE-2026-74221, CVE-2026-74222 +1 more CVEs: U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback

CVE-2026-74220

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Microsoft Security Response Center, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Microsoft Security Response Center’s CVSS 3.1 assessment rates confidentiality impact as none; integrity impact as low; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-74221

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Microsoft Security Response Center, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Microsoft Security Response Center’s CVSS 3.1 assessment rates confidentiality impact as none; integrity impact as low; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-74222

Affected technology

U-Boot · before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 4.0 assessment rates confidentiality impact as none; integrity impact as low; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-74225

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

An attacker could possibly use this issue to trigger a buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-74220, CVE-2026-74221) Shahriyar Jalayeri and Mehrun P.