Read the docs
TI-2026-52019 Aliases CVE-2026-74225GHSA-c478-wgg8-3gvq

U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6

Priority LOW 31CWE-787Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00229 13th percentileScored 2026-11-07
Fix Fixed u-boot (u-boot): 2026.10-rc5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
u-bootu-bootbefore 2026.10-rc52026.10-rc5Patch availableCNA
  • u-boot Vendoru-boot Affected before 2026.10-rc5 Fixed in 2026.10-rc5 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*——u-boot
  • cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:* Versions — — ·u-boot

Remediation

  • Fix · CNA u-boot (u-boot) Fixed in 2026.10-rc5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    u-boot 2026.10-rc5

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-52018 U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive CallbackPriority MEDIUM 44
    • TI-2026-52017 U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINKPriority MEDIUM 44
    • TI-2026-52016 U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ ReplyPriority MEDIUM 44
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-74225
  2. 2026-10-03 Alias added: GHSA-c478-wgg8-3gvq

References

Patch 1

Other 2

  • TI-2022-02168 Unchecked Download size in Uboot CVSS 3.1HIGH 7.7
  • TI-2025-28794 A lack of signature verification in the bootloader of DENX Software Engineering Das… CVSS 3.1MEDIUM 6.5
  • TI-2020-06770 In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c… CVSS 3.1CRITICAL 9.8
  • TI-2022-12898 nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has… CVSS 3.1CRITICAL 9.8
  • TI-2019-10569 An issue was discovered in Das U-Boot through 2019.07. CVSS 3.0CRITICAL 9.8
  • TI-2019-10568 An issue was discovered in Das U-Boot through 2019.07. CVSS 3.0CRITICAL 9.8
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences