High 7.1Published Sep 29, 2026

CVE-2026-74225U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6

Updated under an hour ago (2026-10-19 10:00 UTC)

Does this affect you?

It affects u-boot. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.23%, higher than 13% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for u-boot

Exploited in the last 30 days

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness (CWE): CWE-787
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.23% (percentile 13)
Assigned by: VulnCheck
NVD analysis: Awaiting Analysis
Record last updated: Sep 30, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

u-boot u-boot u_boot:u_boot (from the name)	before 2026.10-rc5	CNA record

References

https://github.com/u-boot/u-boot/commit/20209a62bc8565fc1e040882bc03c71ff0d73076patch
https://github.com/u-boot/u-boot/blob/v2026.07/net/dhcpv6.c#L304technical-description
https://github.com/u-boot/u-bootproduct
https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-out-of-bounds-write-via-dhcpv6third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.