CVE-2026-74225

EUVD-2026-89436
U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
ADJACENT_NETWORK
LOW
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 13.82%
Debian logo
Debian Releases
Debian Product
Codename
u-boot
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
u-boot
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
Fixed in 2025.10-0ubuntu0.24.04.4
released
resolute
Fixed in 2025.10-0ubuntu2.2
released
stonking
Fixed in 2025.10-0ubuntu6
released
xenial
not-affected
u-boot-nezha
jammy
needs-triage
noble
needs-triage
resolute
dne
stonking
dne
Common Weakness Enumeration
References
https://github.com/u-boot/u-boot
https://github.com/u-boot/u-boot/blob/v2026.07/net/dhcpv6.c#L304
https://github.com/u-boot/u-boot/commit/20209a62bc8565fc1e040882bc03c71ff0d73076
https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-out-of-bounds-write-via-dhcpv6