{"id":"CVE-2026-74225","aliases":["DEBIAN-CVE-2026-74225","EUVD-2026-89436","GHSA-c478-wgg8-3gvq","UBUNTU-CVE-2026-74225","USN-8930-1","USN-8930-2"],"status":"published","title":"U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6","description":"U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00229,"percentile":0.13834,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-09-29T21:29:24Z","modified":"2026-10-28T10:55:29Z","fixes":[{"ecosystem":"Ubuntu:24.04:LTS","package":"u-boot","fixed_in":["2025.10-0ubuntu0.24.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"u-boot","fixed_in":["2025.10-0ubuntu6"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"u-boot","fixed_in":["2025.10-0ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2023.01+dfsg-2","2023.01+dfsg-2+deb12u1","2023.01+dfsg-2+deb12u2","2023.01+dfsg-2+deb12u3","2023.04+dfsg-1","2023.04~rc2+dfsg-1","2023.04~rc5+dfsg-1","2023.07+dfsg-1","2023.07~rc4+dfsg-1","2023.07~rc5+dfsg-1","2024.01+dfsg-1","2024.01+dfsg-2","2024.01+dfsg-3","2024.01+dfsg-4","2024.01+dfsg-5","2024.01+dfsg-6","2024.01+dfsg-7","2024.01~rc6+dfsg-1","2024.01~rc6+dfsg-2","2025.01-1","2025.01-2","2025.01-3","2025.01-3.1","2025.01-3.2"]},{"source":"osv","ecosystem":"Debian:13","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.01-3","2025.01-3+deb13u1","2025.01-3.1","2025.01-3.2"]},{"source":"osv","ecosystem":"Debian:14","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.01-3","2025.01-3.1","2025.01-3.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"u-boot-nezha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2021.09+git20211008.62392d3-0ubuntu1","2022.04+git20220405.7446a472-0ubuntu0.1","2022.04+git20220405.7446a472-0ubuntu0.2","2022.04+git20220405.7446a472-0ubuntu0.3","2022.04+git20220405.7446a472-0ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.10-0ubuntu0.24.04.4"}]}],"versions":["2023.07+dfsg-1ubuntu2","2024.01+dfsg-1ubuntu1","2024.01+dfsg-1ubuntu2","2024.01+dfsg-1ubuntu3","2024.01+dfsg-1ubuntu4","2024.01+dfsg-1ubuntu5","2024.01+dfsg-1ubuntu5.1","2024.01+dfsg-1ubuntu5.2","2025.01-0ubuntu0.24.04.1","2025.01-0ubuntu0.24.04.2","2025.10-0ubuntu0.24.04.1","2025.10-0ubuntu0.24.04.2","2025.10-0ubuntu0.24.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"u-boot-nezha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2022.10-1089-g528ae9bc6c-0ubuntu2","2024.01~rc1-190-g2e89b706f5-0ubuntu1","2024.01~rc1-190-g2e89b706f5-0ubuntu2","2024.01~rc1-190-g2e89b706f5-0ubuntu2.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.10-0ubuntu6"}]}],"versions":["2025.10-0ubuntu2","2025.10-0ubuntu3","2025.10-0ubuntu4","2025.10-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.10-0ubuntu2.2"}]}],"versions":["2025.01-3ubuntu4","2025.10-0ubuntu1","2025.10-0ubuntu2","2025.10-0ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.01+dfsg1-2ubuntu5+esm2"}]}],"versions":["2015.04+dfsg1-2ubuntu1","2015.10+dfsg1-2","2015.10+dfsg1-3","2015.10+dfsg1-4","2016.01+dfsg1-1","2016.01+dfsg1-1ubuntu1","2016.01+dfsg1-2ubuntu1","2016.01+dfsg1-2ubuntu2","2016.01+dfsg1-2ubuntu3","2016.01+dfsg1-2ubuntu5","2016.01+dfsg1-2ubuntu5+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.10+dfsg-1ubuntu0~18.04.3+esm2"}]}],"versions":["2016.03+dfsg1-6ubuntu2","2018.07~rc3+dfsg1-0ubuntu1~18.04.1","2018.07~rc3+dfsg1-0ubuntu2~18.04.1","2018.07~rc3+dfsg1-0ubuntu3~18.04.1","2019.07+dfsg-1ubuntu4~18.04.1","2020.10+dfsg-1ubuntu0~18.04.2","2020.10+dfsg-1ubuntu0~18.04.3","2020.10+dfsg-1ubuntu0~18.04.3+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01+dfsg-3ubuntu0~20.04.6+esm2"}]}],"versions":["2019.07+dfsg-1ubuntu3","2019.07+dfsg-1ubuntu5","2019.07+dfsg-1ubuntu6","2020.10+dfsg-1ubuntu0~20.04.2","2021.01+dfsg-3ubuntu0~20.04.1","2021.01+dfsg-3ubuntu0~20.04.3","2021.01+dfsg-3ubuntu0~20.04.4","2021.01+dfsg-3ubuntu0~20.04.5","2021.01+dfsg-3ubuntu0~20.04.6","2021.01+dfsg-3ubuntu0~20.04.6+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.01+dfsg-2ubuntu2.9"}]}],"versions":["2021.07+dfsg-0ubuntu8","2021.07+dfsg-0ubuntu9","2021.07+dfsg-0ubuntu10","2022.01+dfsg-2ubuntu1","2022.01+dfsg-2ubuntu2","2022.01+dfsg-2ubuntu2.1","2022.01+dfsg-2ubuntu2.3","2022.01+dfsg-2ubuntu2.4","2022.01+dfsg-2ubuntu2.5","2022.01+dfsg-2ubuntu2.6","2022.01+dfsg-2ubuntu2.7","2022.01+dfsg-2ubuntu2.8"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.10-0ubuntu0.24.04.4"}]}],"versions":["2023.07+dfsg-1ubuntu2","2024.01+dfsg-1ubuntu1","2024.01+dfsg-1ubuntu2","2024.01+dfsg-1ubuntu3","2024.01+dfsg-1ubuntu4","2024.01+dfsg-1ubuntu5","2024.01+dfsg-1ubuntu5.1","2024.01+dfsg-1ubuntu5.2","2025.01-0ubuntu0.24.04.1","2025.01-0ubuntu0.24.04.2","2025.10-0ubuntu0.24.04.1","2025.10-0ubuntu0.24.04.2","2025.10-0ubuntu0.24.04.3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.10-0ubuntu2.2"}]}],"versions":["2025.01-3ubuntu4","2025.10-0ubuntu1","2025.10-0ubuntu2","2025.10-0ubuntu2.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.10-0ubuntu6"}]}],"versions":["2025.10-0ubuntu2","2025.10-0ubuntu3","2025.10-0ubuntu4","2025.10-0ubuntu5"],"bundled":4}],"products":[{"vendor":"denx software engineering","product":"u-boot"},{"vendor":"u-boot","product":"u-boot"}],"references":[{"url":"https://github.com/u-boot/u-boot/commit/20209a62bc8565fc1e040882bc03c71ff0d73076","tags":["patch","fix","report"]},{"url":"https://github.com/u-boot/u-boot/blob/v2026.07/net/dhcpv6.c#L304","tags":["technical-description","article","report"]},{"url":"https://github.com/u-boot/u-boot","tags":["product","package","report"]},{"url":"https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-out-of-bounds-write-via-dhcpv6","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74225","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c478-wgg8-3gvq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74225.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-74225","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-74225","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74225","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8930-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8930-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-74220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74222","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-74225","title":"U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6","description":"U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.","status":"published","published":"2026-09-29T21:29:24.652Z","modified":"2026-09-30T19:17:11.293Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:20:03.081354Z"}],"euvd":[{"id":"EUVD-2026-89436","description":"U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.","status":"published","published":"2026-09-29T21:29:24Z","modified":"2026-09-30T19:17:11Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:47.733217Z"}],"ghsa":[{"id":"GHSA-c478-wgg8-3gvq","title":"U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that...","description":"U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.","status":"published","published":"2026-09-30T00:32:29Z","modified":"2026-09-30T00:32:46Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:12:35.132592Z"}],"nvd":[{"id":"CVE-2026-74225","description":"U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.","status":"published","published":"2026-09-29T22:18:33.827Z","modified":"2026-09-30T20:17:34.617Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:52.759595Z"}],"osv":[{"id":"CVE-2026-74225","title":"U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6","description":"U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.","status":"published","published":"2026-09-29T21:29:24.652Z","modified":"2026-10-28T10:55:29.477325474Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:45:16.365946Z"},{"id":"DEBIAN-CVE-2026-74225","description":"U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.","status":"published","published":"2026-09-29T22:18:33.827Z","modified":"2026-10-01T09:00:54.472960313Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"UBUNTU-CVE-2026-74225","description":"U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.","status":"published","published":"2026-09-29T22:18:00Z","modified":"2026-10-21T23:11:56.250830371Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"USN-8930-1","title":"u-boot vulnerabilities","description":"Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot\nincorrectly handled certain NFS READ and NFS READLINK responses. An\nattacker could possibly use this issue to trigger a buffer overflow,\nresulting in a denial of service or arbitrary code execution.\n(CVE-2026-74220, CVE-2026-74221)\n\nShahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot\nincorrectly handled certain HTTP data storage failures in its lwIP\nimplementation. An attacker could possibly use this issue to trigger a\nuse-after-free, resulting in a denial of service. This issue only\naffected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-74222)\n\nShahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot did not\nproperly validate certain DHCPv6 option lengths during network boot. An\nattacker could possibly use this issue to trigger out-of-bounds memory\naccess, resulting in a denial of service. This issue only affected\nUbuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-74225)","status":"published","published":"2026-10-14T16:23:58Z","modified":"2026-10-17T13:11:53.933670443Z","updated_at":"2026-11-02T16:58:26.907654Z"},{"id":"USN-8930-2","title":"u-boot vulnerabilities","description":"USN-8930-1 fixed some vulnerabilities in U-Boot. This update provides the\ncorresponding fix for U-Boot on Ubuntu 26.10.\n\nOriginal advisory details:\n\n Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot\nincorrectly handled certain NFS READ and NFS READLINK responses. An\nattacker could possibly use this issue to trigger a buffer overflow,\nresulting in a denial of service or arbitrary code execution.\n(CVE-2026-74220, CVE-2026-74221)\n\n Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot\nincorrectly handled certain HTTP data storage failures in its lwIP\nimplementation. An attacker could possibly use this issue to trigger a\nuse-after-free, resulting in a denial of service. (CVE-2026-74222)\n\n Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot did not\nproperly validate certain DHCPv6 option lengths during network boot. An\nattacker could possibly use this issue to trigger out-of-bounds memory\naccess, resulting in a denial of service. (CVE-2026-74225)","status":"published","published":"2026-10-21T15:57:11Z","modified":"2026-10-21T23:13:03.440289031Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}