Log in Start free

Vulnerability · Published Sep 29, 2026 · Assigned by VulnCheck

CVE-2026-74225U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6

High 7.1

In plain English

A high-severity out-of-bounds write in u-boot from u-boot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.2%top 86.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12u-bootno fix listedDEBIAN-CVE-2026-74225
Debian:13u-bootno fix listedDEBIAN-CVE-2026-74225
Debian:14u-bootno fix listedDEBIAN-CVE-2026-74225
Ubuntu:22.04:LTSu-boot2022.01+dfsg-2ubuntu2.9USN-8930-1
Ubuntu:24.04:LTSu-boot2025.10-0ubuntu0.24.04.4USN-8930-1
Ubuntu:24.04:LTSu-boot2025.10-0ubuntu0.24.04.4UBUNTU-CVE-2026-74225
Ubuntu:26.04:LTSu-boot2025.10-0ubuntu2.2USN-8930-1
Ubuntu:26.04:LTSu-boot2025.10-0ubuntu2.2UBUNTU-CVE-2026-74225
Ubuntu:26.10u-boot2025.10-0ubuntu6USN-8930-2
Ubuntu:26.10u-boot2025.10-0ubuntu6UBUNTU-CVE-2026-74225
Ubuntu:22.04:LTSu-boot-nezhano fix listedUBUNTU-CVE-2026-74225
Ubuntu:24.04:LTSu-boot-nezhano fix listedUBUNTU-CVE-2026-74225

Affected products (as reported)

VendorProductVersions
u-boot u-boot 0 – before 2026.10-rc5

Weakness: CWE-787 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

References