PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-14196 Denx CVE debrief

CVE-2019-14196 is a critical memory corruption vulnerability in Das U-Boot affecting versions through 2019.07. The issue is described as an unbounded memcpy after a failed length check in nfs_lookup_reply, which maps to CWE-787 (out-of-bounds write). Because the CVSS vector is network-exploitable with no privileges or user interaction and with high confidentiality, integrity, and availability impact, this should be treated as an urgent firmware-risk issue for embedded systems that use U-Boot and NFS-related boot paths.

Vendor
Denx
Product
CVE-2019-14196
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2019-07-31
Original CVE updated
2026-05-12
Advisory published
2019-07-31
Advisory updated
2026-05-12

Who should care

Embedded device vendors, firmware and bootloader maintainers, OEMs, industrial control and appliance teams, and security teams responsible for products that ship U-Boot or depend on NFS boot flows.

Technical summary

NVD describes the flaw as an unbounded memcpy in nfs_lookup_reply following a failed length check, affecting Denx U-Boot through 2019.07. The vulnerability is categorized as CWE-787 and scored CVSS 3.0 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The affected CPE range in the record ends at version 2019.07 inclusive.

Defensive priority

Critical. The combination of network attackability, no authentication, and potential full impact on confidentiality, integrity, and availability makes this a high-priority firmware remediation item.

Recommended defensive actions

  • Upgrade U-Boot to a vendor-fixed release newer than 2019.07, or backport the upstream/vendor patch if upgrading is not immediately possible.
  • Inventory products and images that include U-Boot, especially those that use NFS boot or related network boot features.
  • Reduce exposure of boot services and management networks so U-Boot-based network boot paths are not reachable from untrusted segments.
  • Validate firmware build pipelines to ensure affected bootloader versions are not reintroduced into new device images.
  • If immediate remediation is delayed, document compensating controls and track affected devices until the fix is deployed.

Evidence notes

The vulnerability description, affected version range, CWE mapping, and CVSS data come from the NVD CVE record for CVE-2019-14196. The record cites third-party advisory and upstream project references, including a Semmle blog post and the U-Boot GitLab project, plus downstream references from Debian LTS and Siemens CERT.

Official resources

Publicly disclosed on 2019-07-31, based on the CVE and NVD published timestamps supplied here. The later 2026-05-12 modification reflects record updates, not the original issue date.