Is CVE-2026-29007 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29007 being exploited in the wild.

How severe is CVE-2026-29007?

Medium severity, with a CVSS score of 5.3, published 8 July 2026.

Which products and versions are affected?

Das U-Boot project U-Boot through 2026.04-rc3.

Is there a fix for CVE-2026-29007?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-29007 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-29007?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29007: U-Boot out-of-bounds read in tcp_rx_state_machine

CVE-2026-29007 · Severity: medium · CVSS 5.3 · Published 2026-07-08

U-Boot is an open-source bootloader used to initialize hardware and start the operating system on various devices. A flaw in its networking component allows a remote attacker to send specially crafted network packets that cause the system to read memory outside of the intended area. This can lead to the corruption of internal connection settings, potentially causing network communication failures or system instability during the boot process.

Quick answers

Is CVE-2026-29007 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29007 being exploited in the wild.
How severe is CVE-2026-29007?: Medium severity, with a CVSS score of 5.3, published 8 July 2026.
Which products and versions are affected?: Das U-Boot project U-Boot through 2026.04-rc3.
Is there a fix for CVE-2026-29007?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-29007 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-29007?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability exists in the `tcp_rx_state_machine()` function within `net/tcp.c` when `CONFIG_PROT_TCP` is enabled. The flaw is triggered by a mismatch between the IP total length and the TCP data offset field in a received packet. Specifically, an attacker can send a packet with a small IP total length (e.g., 40 bytes) but a larger TCP data offset (e.g., 60 bytes), causing `tcp_parse_options()` to read memory beyond the actual TCP segment. This can result in the corruption of connection state variables such as `rmt_win_scale` and `rmt_timestamp`, leading to a denial of service or disruption of TCP window calculations. The vulnerability is reachable over the network without authentication.

Affected products

Das U-Boot project U-Boot through 2026.04-rc3

Timeline

2026-05-08: disclosed: Initial outreach to U-Boot mailing list by VulnCheck
2026-07-08: advisory: CVE-2026-29007 published by NVD and VulnCheck

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.