CVE-2026-74225: U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6
Last updated 14 October 2026
Other sources
U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6parseoptions() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
U-Bootto a version that resolves this vulnerability.Fixed in 2026.10-rc5
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running an affected U-Boot version and performing DHCPv6 during netboot are exposed. Exploitation requires an attacker to be on the local network where they can send DHCPv6 traffic to the booting device.
What does an attacker need to do to exploit it?
An unauthenticated attacker needs to send a crafted DHCPv6 ADVERTISE or REPLY packet with malformed SERVERID or CLIENTID option lengths while the target is processing DHCPv6 during netboot. No user interaction or prior privileges are required.
What is the impact of successful exploitation?
Malformed option lengths can cause out-of-bounds memory access and memory corruption in the bootloader. The described outcome includes crashing U-Boot; integrity impact is also rated as low.
What can be done if updating is not immediately possible?
Limit exposure to untrusted local networks during netboot and prevent untrusted hosts from sending DHCPv6 responses to booting devices. The vulnerable parsing path is associated with DHCPv6 processing during netboot.