How many CVEs does the NVD list for my U-Boot version?
Counted are CVEs whose NVD configuration lists the version as vulnerable, queried on 27 October 2026 through the NVD API, without rejected entries, each hit re-checked against its configuration. The NVD lists U-Boot as cpe:2.3:a:denx:u-boot. The CPE dictionary ends at 2026.04; 2026.07 and 2026.10 have no entry yet.
For 2026.04 the query returns four hits that only concern release candidates rc1 to rc3. They are not counted; one of them affects the release anyway (see below).
| Version, release date | CVEs according to the NVD, of which CVSS 9.0 or higher |
|---|---|
| 2026.10, 5 Oct 2026 (newest) | none, not in the CPE dictionary |
| 2026.07, 6 Jul 2026 | none, not in the CPE dictionary |
| 2026.04, 6 Apr 2026 | none; in fact at least 1 at 9.0 or higher (CVE-2026-29009) |
| 2026.01, 5 Jan 2026 | 4 CVEs, 1 at 9.0 or higher |
| 2025.04, 7 Apr 2025 | 5 CVEs, 1 at 9.0 or higher |
| 2024.04, 2 Apr 2024 | 11 CVEs, 1 at 9.0 or higher |
| 2023.04, 3 Apr 2023 | 11 CVEs, 1 at 9.0 or higher |
| 2022.04, 4 Apr 2022 | 16 CVEs, 3 at 9.0 or higher |
| 2021.01, 11 Jan 2021 | 18 CVEs, 3 at 9.0 or higher |
| 2020.04, 13 Apr 2020 | 16 CVEs, 3 at 9.0 or higher |
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:a:denx:u-boot:2023.04&noRejected" \
| jq .totalResults11curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:a:denx:u-boot:2026.01&noRejected" \
| jq .totalResults4Which U-Boot CVEs have CVSS 9.0 or higher?
| CVE, CVSS (NVD) | What, precondition, affected versions |
|---|---|
| CVE-2026-29009, 9.8 | Buffer overflow in nfs_readlink_reply() when U-Boot loads over NFS (CONFIG_CMD_NFS). The NVD counts up to before 2026.04, but the fix is only in 2026.07, so 2026.04 is affected. |
| CVE-2022-30767, 9.8 | nfs_lookup_reply, an incomplete fix of CVE-2019-14196. Up to 2022.04. |
| CVE-2022-34835, 9.8 | Stack overflow in the i2c md command. Up to 2022.04. |
Which U-Boot CVEs are missing from the version query?
Eleven U-Boot CVEs, published in August and September 2026, have no NVD configuration yet and appear in no version query. According to their own records all eleven affect every version up to 2026.01, nine of them also 2026.04, eight also 2026.07, and one also the newest release 2026.10. Three of them score 9.0 or higher by their own scores.
Two CVEs from 2022 (CVE-2022-30790 and CVE-2022-30552) are configured by the NVD only for exactly 2022.01; queries for 2020.04, 2021.01 and 2022.04 do not find them. CVE-2023-39902 in U-Boot's SPL is listed only under NXP i.MX 8M, not under U-Boot.
| CVE, score | What, affected according to the record |
|---|---|
| CVE-2025-70290, 9.8 (CISA) | Integer overflow in the ZFS code, before 2026.04 |
| CVE-2025-70293, 9.8 (CISA) | Overflow in ext4fs_get_bgdtable, before 2026.04 |
| CVE-2026-15390, 9.0 (CERT-PL, CVSS 4.0) | IP reassembly with CONFIG_IP_DEFRAG, code execution, 2009.08 to before 2026.07 |
| CVE-2026-71971, 8.2 | Out-of-bounds write in __net_defragment, before 2026.10-rc3 |
| CVE-2026-74220 and -74221, 8.2 each | Overflows in nfs_read_reply and nfs_readlink_reply, before 2026.10-rc5 |
| CVE-2026-74222, 8.2 | Use-after-free in the HTTP client of wget (lwIP), before 2026.10-rc5 |
| CVE-2026-74225, 7.1 | dhcp6_parse_options, before 2026.10-rc5 |
| CVE-2026-71972, 5.9 | video_display_rle8_bitmap; the fix is not in 2026.10, the newest release is affected |
| CVE-2026-71973 and -71974, 5.2 and 4.8 | SquashFS directory table and partition table, before 2026.10-rc4 and rc3 |
Which U-Boot lines do NXP, ST and TI maintain?
U-Boot is released every three months, on the first Monday of January, April, July and October. There is no LTS line; bug-fix releases of the form 2023.07.02 are rare. The next release, 2027.01, is scheduled for 4 January 2027.
Industrial gateways usually carry the chip vendor's U-Boot, not an upstream release. NXP maintains uboot-imx with branches from lf_v2021.04 to lf_v2026.04, ST v2026.04-stm32mp-r1 for STM32MP, TI ti-u-boot-2023.04 to ti-u-boot-2026.01. What counts is which fixes the vendor took into its branch.
Where is the U-Boot version in the image?
U-Boot writes its version as one string into the image and prints it at boot, such as „U-Boot 2023.04 (Apr 03 2023 - 12:00:00 +0000)“, and in the SPL „U-Boot SPL 2026.10“. The string is version_string, up to 2023 in cmd/version.c, from 2024.04 in common/version.c. Vendors often append their own identifier, such as a Git hash or a branch name.
curl -s https:/Output
21:const char version_string[] = U_BOOT_VERSION_STRING;How do I check this by hand?
- 1
Read the version:
strings -a u-boot.bin | grep -m1 "U-Boot 20", in the source tree from theMakefile(VERSION,PATCHLEVEL). - 2
Clarify the origin: upstream release or a chip vendor's branch (NXP, ST, TI).
- 3
Query the NVD with
cpe:2.3:a:denx:u-boot:<version>; 2026.07 and newer have no entry yet. - 4
Read the CVEs without NVD configuration against your version, for example in Debian's security pages for U-Boot.
- 5
Check the configuration: many vulnerabilities concern NFS, TCP, IP reassembly or single file systems and only apply if those parts are in the build (
.config). - 6
Check the CISA KEV catalogue for actively exploited vulnerabilities.
Can this run automatically?
LegacyMind reads the bootloader, the kernel and the packages with their versions from the image and checks each against the vulnerability sources, with the place in the image where it was found. If the image proves no version, the field stays empty.
Questions
Is U-Boot 2026.10 free of known vulnerabilities?
No. The NVD counts no CVE for it, because 2026.10 is not in the CPE dictionary yet. The fix for CVE-2026-71972 is not in 2026.10, though.
How many CVEs does U-Boot 2023.04 have?
The NVD lists 11 on 27 October 2026, one of them at 9.0 or higher. On top come the eleven CVEs without NVD configuration, which according to their records also affect 2023.04.
Is a U-Boot vulnerability actively exploited?
As of 27 October 2026 no U-Boot vulnerability is in the CISA catalogue of known exploited vulnerabilities (catalogue version 2026.10.26).
Is there an LTS version of U-Boot?
No. U-Boot is released every three months without an LTS line. Long-maintained states come from the chip vendors, such as NXP lf_v2023.04 or TI ti-u-boot-2023.04.