U-Boot CVE-2026-74225

Requires the target device to be actively performing a DHCPv6-based network boot (netboot), and the attacker must be on the same local network link to send crafted DHCPv6 ADVERTISE or REPLY packets with oversized SERVERID/CLIENTID (DUID) option lengths. No authentication or user interaction is needed (PR:N/UI:N), but exploitation is limited to the brief netboot window and to adjacent-network position (AV:A) - devices that boot from local storage and never invoke DHCPv6 netboot are not exposed. Affected U-Boot versions are those before 2026.10-rc5.

Signals point to a moderate, availability-focused risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H, 7.1) describes an adjacent-network, low-complexity, unauthenticated flaw whose dominant impact is availability (VA:H = bootloader crash) with only limited integrity impact (VI:L) and no confidentiality loss - consistent with the CWE-787 out-of-bounds write and the description's 'corrupt memory and crash the bootloader.' Two facts sharply narrow real-world risk: exploitation only occurs while a device is performing DHCPv6 netboot, and the attacker must be on the same local link (AV:A, not AV:N). No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so the exploitation status is: no public exploit identified at time of analysis. The vulnerability is real and vendor-confirmed with a patch, but the combination of adjacent-only access, a transient netboot trigger window, and crash-not-code-execution impact makes this a manage-and-patch item rather than an urgent, mass-exploitable threat. No signals conflict; the CVSS adjacent/DoS framing matches the description well.

An attacker with a foothold on the same LAN segment as a device that netboots over DHCPv6 (e.g., a PXE-style embedded appliance or network gear) races or spoofs the DHCPv6 server to send a crafted ADVERTISE or REPLY packet with an oversized SERVERID/CLIENTID (DUID) option length. U-Boot's dhcp6_parse_options() copies/compares using the attacker-controlled length without bounds checking, writing out of bounds and crashing the bootloader (denial of service / boot disruption). No public exploit is identified at time of analysis, and access is limited to the adjacent network.