CVE-2026-74225

HIGHCVSS 7.1

Description

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.

Timeline

Published:September 29th, 2026 10:18 PM

Last modified:September 30th, 2026 8:17 PM

CVSS Scoring

CVSS v3: 7.1 (HIGH)

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses (CWE)

CWE-787

References & Reports

Advisories, patches, and third-party reports

https://github.com/u-boot/u-boot
https://github.com/u-boot/u-boot/blob/v2026.07/net/dhcpv6.c#L304
https://github.com/u-boot/u-boot/commit/20209a62bc8565fc1e040882bc03c71ff0d73076
https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-out-of-bounds-write-via-dhcpv6

Source: NIST NVD · Data may lag official sources by up to one minute