CVE-2026-74225: U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6
U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6parseoptions() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running an affected U-Boot version and performing DHCPv6 during netboot are exposed. Exploitation requires an attacker to be on the local network where they can send DHCPv6 traffic to the booting device.
What does an attacker need to do to exploit it?
An unauthenticated attacker needs to send a crafted DHCPv6 ADVERTISE or REPLY packet with malformed SERVERID or CLIENTID option lengths while the target is processing DHCPv6 during netboot. No user interaction or prior privileges are required.
What is the impact of successful exploitation?
Malformed option lengths can cause out-of-bounds memory access and memory corruption in the bootloader. The described outcome includes crashing U-Boot; integrity impact is also rated as low.
What can be done if updating is not immediately possible?
Limit exposure to untrusted local networks during netboot and prevent untrusted hosts from sending DHCPv6 responses to booting devices. The vulnerable parsing path is associated with DHCPv6 processing during netboot.