PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-14204 Denx CVE debrief

CVE-2019-14204 is a critical memory-corruption issue in Das U-Boot through 2019.07. The NVD description identifies a stack-based buffer overflow in the NFS reply helper function nfs_umountall_reply. The published CVSS 3.0 vector indicates a network-reachable issue with no privileges or user interaction required, and potential high impact to confidentiality, integrity, and availability.

Vendor
Denx
Product
CVE-2019-14204
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2019-07-31
Original CVE updated
2026-05-12
Advisory published
2019-07-31
Advisory updated
2026-05-12

Who should care

Teams that deploy or maintain U-Boot in embedded devices, bootloaders, appliances, or systems that use NFS-related boot or management paths should treat this as urgent. Security owners should also care if they inventory firmware but do not routinely track bootloader versions.

Technical summary

NVD classifies the weakness as CWE-787 and lists affected U-Boot versions through 2019.07. The issue is described as a stack-based buffer overflow in the nfs_handler reply helper function nfs_umountall_reply. The CVSS vector in NVD is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable, low-complexity condition with no privileges or user interaction required.

Defensive priority

Critical: prioritize immediately for any exposed or widely deployed U-Boot instance, especially systems using NFS-related functionality.

Recommended defensive actions

  • Inventory devices and firmware that use U-Boot, and identify any builds at or below 2019.07.
  • Apply vendor or platform guidance from the referenced advisory sources and move to a non-vulnerable U-Boot release when available.
  • Reduce exposure of affected boot or NFS-related paths where practical until remediation is complete.
  • Validate whether embedded products ship U-Boot as part of the boot chain, even if the main OS is patched.
  • Track this issue in firmware risk management and include it in emergency update planning for customer-facing devices.

Evidence notes

The NVD record states that the issue affects Denx U-Boot through 2019.07 and describes a stack-based buffer overflow in nfs_umountall_reply. NVD also lists CWE-787 and the CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The supplied NVD references include a third-party advisory, the U-Boot GitLab project, and a Siemens CERT advisory page, which should be used for vendor-side remediation context.

Official resources

Publicly disclosed in the NVD record on 2019-07-31. The supplied corpus also shows a later NVD modification date of 2026-05-12; that is a record update date, not the vulnerability's original disclosure date.