CVE-2026-74225CWE-787

CVE-2026-74225

High · published September 30, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
13.3
In the wild
Unconfirmed
What it is

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
EPSS
0.00232 · 13.3th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-09-30T02:18Z
References (4)
https://github.com/u-boot/u-boot · [email protected]https://github.com/u-boot/u-boot/blob/v2026.07/net/dhcpv6.c#L304 · [email protected]https://github.com/u-boot/u-boot/commit/20209a62bc8565fc1e040882bc03c71ff0d73076 · [email protected]https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-out-of-bounds-write-via-dhcpv6 · [email protected]
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 0%
    epss
  • 29 SEP 21:29Z
    U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6
    cvelistv5