2164 matches found
CVE-2026-74222
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpcrecvcb function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERRBUF instead of ERRABRT, causing the TCP input path to access released memory and...
UBUNTU-CVE-2026-74222
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpcrecvcb function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERRBUF instead of ERRABRT, causing the TCP input path to access released memory and...
CVE-2026-74225 U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6
U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6parseoptions that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the...
CVE-2026-74221
U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadlinkreply function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader...
CVE-2026-74222 U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpcrecvcb function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERRBUF instead of ERRABRT, causing the TCP input path to access released memory and...
CVE-2026-74221
Versions of U-Boot prior to 2026.10-rc5 are susceptible to a buffer overflow in the nfs_readlink_reply() function located in net/nfs-common.c. The vulnerability occurs when the bootloader processes responses from an NFS server that provides crafted READLINK replies containing negative or oversize...
CVE-2026-74222 U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpcrecvcb function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERRBUF instead of ERRABRT, causing the TCP input path to access released memory and...
CVE-2026-74222
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpcrecvcb function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERRBUF instead of ERRABRT, causing the TCP input path to access released memory and...
CVE-2026-74222
U-Boot versions before 2026.10-rc5 are vulnerable to a use-after-free flaw in the httpc_recv_cb() function of the lwIP wget implementation. The vulnerability occurs when HTTP data storage fails: the callback frees the connection PCB but incorrectly returns ERR_BUF instead of ERR_ABRT. This error ...
CVE-2026-71974 U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read
U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on...
CVE-2026-71974 U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read
U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on...
CVE-2026-71974
U-Boot versions prior to 2026.10-rc3 are vulnerable to an out-of-bounds write in the read_slotted_partition() function. The flaw exists because the system fails to validate image sizes against partition bounds. An attacker with physical access can exploit this by providing crafted boot media cont...
CVE-2026-71974 U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read
U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on...
CVE-2026-71974
U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on...
CVE-2026-71972 U-Boot through 2026.10-rc5 Out-of-Bounds Write in BMP RLE8 Decoder
U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the videodisplayrle8bitmap function in drivers/video/videobmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader...
ghostlock-k419-adapter
GhostLock — 一加锁定 Bootloader 越狱 针对锁定 Bootloader 的一加/OPPO/realme 设备的内核漏洞利用程序。无需解锁 Bootloader 或修改启动镜像，即可获取 root 权限并安装 KernelSU。通过多设备偏移表在运行时自动检测内核版本。 漏洞 CVE-2026-43499 — Futex PI（优先级继承）释放后使用（Use-After-Free） 影响 Linux 内核 2.6.39 7.1。已在主线 7.1 中修复（提交 3bfdc63936dd）。Android GKI 6.12.x 仍存在漏洞。 pselect6 系统调用会将...
CVE-2026-43499
CVE-2026-43499 一种通过新型漏洞对锁定引导加载程序的Android设备进行root的修改方法。（目前仅适用于三星或类似设备，因为我将其移植到了N970U1），Fork of https://github.com/localhosts-A/CyberMeowfia...
realme-c53-unlock-root
Realme C53 RMX3760 — Bootloader Unlock & Root Toolkit English | Bahasa Indonesia Unlock bootloader and root your Realme C53 and other Realme devices. Supports KernelSU, Magisk, or a hybrid of both. ⚠️ RMX3760 Unisoc T612 : Bootloader unlock + Magisk root are verified working on BOTH Android 15 and...
CRACK12
CRACK12 Android 14を搭載したATOZEE P12をCVE-2022-38694を使ってroot化する — fastboot oem unlockが拒否したから、別の方法を見つけた。 これって何？ こんなタブレットがあるんだ。ATOZEE P12。聞いたことないでしょ。誰も知らない。値段は約80ドルで、メーカー名はキーボードに顔をぶつけて寝たみたいな名前。Android 14搭載、誰も気にしないUnisocチップ、そしてcom.guanhong.guanhongpcbという謎のアプリがプリインストールされている（今も何のアプリか不明）。 root化したかった。...