CVE-2026-74222
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When
CVSS
8.2
Alto
EPSS
0.3%
p22
KEV
—
Exploit Today
6
0-100
Publicado: 29 sept 2026 · Última mod.: 2 oct 2026 · CWE-416
0.3%EPSS · 30 días0.3%
2026-09-302026-10-20
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, causing the TCP input path to access released memory and crash the bootloader.
- github.comhttps://github.com/u-boot/u-boot
- github.comhttps://github.com/u-boot/u-boot/blob/v2026.07/net/lwip/wget.c#L194
- github.comhttps://github.com/u-boot/u-boot/commit/2d94618a58aeb7630f18eee33419ce48d0fd3616
- www.vulncheck.comhttps://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-use-after-free-in-lwip-wget-receive-callback
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-972067.5 ALT—
——0NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.1hCVE-2026-114111——
——0sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.9hCVE-2026-1140426.5 MED—
——0FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.9hCVE-2026-1133448.8 ALT—
——0Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)10hCVE-2026-1133398.8 ALT—
——0Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)6hCVE-2026-1133388.8 ALT—
——0Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)10h