CVE-2024-42040

CVE Enrichment

CVSS: 8.1 HIGH
EPSS: 0.60%
EPSS Percentile: 47.67%
CISA KEV: Not listed

Description

Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on the local network to leak memory from four up to 32 bytes of memory stored behind the packet to the network depending on the later use of DHCP-provided parameters via crafted DHCP responses.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 23-Aug-2024 22:15
Last Modified: 17-Jun-2026 14:48
EPSS Date: 2026-10-20
CWE: CWE-120

CVSS Vector


            CVSS:3.1                            AV:A /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:N /
                            A:H

Affected Products / Versions

denx / u-boot Source: NVD CPE · affected
Version / affected range: * · through (inclusive) 2025.10
cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*

References

Last enrichment sync: 01-Nov-2026 19:58
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

The same u-boot entry fixes a BOOTP/DHCP buffer overread filed as CVE-2024-42040. Debian 13.7 Bundles 92 Security Advisories and Updates 106 Packages

CVE (19)

Products (18)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.