PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-14194 Denx CVE debrief

CVE-2019-14194 describes a critical flaw in U-Boot through 2019.07 affecting the NFSv2 reply path. In the vulnerable flow, nfs_read_reply can call store_block after a failed length check, resulting in an unbounded memcpy. Because the issue is network-reachable and rated CVSS 9.8, it should be treated as an urgent bootloader hardening and patching priority for any device that uses U-Boot network boot or NFS-based boot logic.

Vendor
Denx
Product
CVE-2019-14194
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2019-07-31
Original CVE updated
2026-05-12
Advisory published
2019-07-31
Advisory updated
2026-05-12

Who should care

Embedded device vendors, OEM firmware teams, bootloader maintainers, and security teams responsible for systems that ship or deploy U-Boot, especially where network boot or NFS boot is enabled.

Technical summary

The NVD record states that U-Boot through 2019.07 contains an unbounded memcpy in nfs_read_reply when calling store_block in the NFSv2 case, with a failed length check. NVD maps the weakness to CWE-787 and assigns CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable memory-corruption issue with high impact.

Defensive priority

Immediate

Recommended defensive actions

  • Upgrade to a U-Boot release that includes the vendor or upstream fix for CVE-2019-14194.
  • If NFS/network boot is not required, disable or remove that boot path to reduce exposure.
  • Apply downstream firmware/vendor patches to any shipped bootloader images, including board-specific forks.
  • Inventory deployed devices and build artifacts to identify U-Boot versions at or below 2019.07.
  • Restrict access to boot services and trusted management networks where network boot must remain enabled.
  • Review vendor advisories and upstream U-Boot security references for patch guidance and backport status.

Evidence notes

The debrief is based on the supplied NVD/CVE corpus: description text says the issue exists in Das U-Boot through 2019.07 and involves an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv2 case. NVD assigns CWE-787 and CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Reference links supplied in the corpus include the CVE record, NVD detail, a Semmle advisory blog, the U-Boot repository, and a Siemens advisory page. CVE published date used here is 2019-07-31; the later NVD modification date is noted only as record context.

Official resources

Publicly disclosed on 2019-07-31. The NVD record was later modified on 2026-05-12; that modified date is record maintenance context, not the vulnerability issue date.