CVE-2026-74225 json
U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6
published 2026-09-29 40 d ago modified 2026-09-30 39 d ago also EUVD-2026-89436
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 13%
- public exploits
- 0
- none known
Summary
U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.
Patch / fix
- u-boot u-boot 2026.10-rc5
- u-boot Ubuntu 24.04 LTS 2025.10-0ubuntu0.24.04.4
- u-boot Ubuntu 26.10 2025.10-0ubuntu6
- u-boot Ubuntu 26.04 LTS 2025.10-0ubuntu2.2
ubuntu advisories UBUNTU-CVE-2026-74225
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 39 d ago
Exploit prediction
0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- u-boot u-boot
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
github.com
/u-boot/u-boot/commit/20209a62bc8565fc1e040882bc03c71ff0d73076
patch
-
github.com
/u-boot/u-boot/blob/v2026.07/net/dhcpv6.c#L304
technical-description
-
github.com
/u-boot/u-boot
product
-
vulncheck.com
/advisories/u-boot-before-2026.10-rc5-out-of-bounds-write-via-dhcpv6
third-party-advisory
Sources
- CVE List CVE-2026-74225
- NVD CVE-2026-74225
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.