CVEvulnerability
CVE-2026-74225
7.1 HIGH
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-09-29
- Last modified
- 2026-09-30
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 7.1 HIGH — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 7.1 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- Weaknesses
- CWE-787
Description
U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.
Related
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness
References
- https://github.com/u-boot/u-boot github.com
- https://github.com/u-boot/u-boot/blob/v2026.07/net/dhcpv6.c#L304 github.com
- https://github.com/u-boot/u-boot/commit/20209a62bc8565fc1e040882bc03c71ff0d73076 github.com
- https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-out-of-bounds-write-via-dhcpv6 www.vulncheck.com