CVE-2026-74225

7.1 HIGHpublic exploit available

Published 2026-09-29 · Updated 2026-09-29

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses

CWE-787

Public exploit & PoC references

https://github.com/u-boot/u-boot
https://github.com/u-boot/u-boot/blob/v2026.07/net/dhcpv6.c#L304
https://github.com/u-boot/u-boot/commit/20209a62bc8565fc1e040882bc03c71ff0d73076

All references

https://github.com/u-boot/u-boot
https://github.com/u-boot/u-boot/blob/v2026.07/net/dhcpv6.c#L304
https://github.com/u-boot/u-boot/commit/20209a62bc8565fc1e040882bc03c71ff0d73076
https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-out-of-bounds-write-via-dhcpv6

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-10027
HIGHCVE-2026-100504PoC
CRITICALCVE-2026-100740
HIGHCVE-2026-100888
MEDIUMCVE-2026-101202
MEDIUMCVE-2026-101203
HIGHCVE-2026-102004
HIGHCVE-2026-102301

Related by shared AI tags and CWE weakness class. Browse the full archive.