Keil MDK-Middleware EUVD-2026-109965

The affected device must be running Arm Keil MDK-Middleware (versions 8.0.0 through 8.3.0) with its IPv6/DHCPv6 functionality enabled and actively processing DHCPv6 option data. Exploitation is bounded by the link-local nature of DHCPv6: the attacker generally must reside on the same local network segment to deliver crafted DHCPv6 messages, which materially limits remote reach despite the input's AV:N label. Impact is further limited to low-severity information disclosure (partial memory over-read) and unintended retransmission affecting availability; there is no integrity impact and no code-execution claim in the sources. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N).

This is a moderate-priority issue, not an emergency. The input CVSS base score is 6.5 (medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, indicating low-impact information disclosure (C:L) plus a low availability effect (A:L) from unintended data retransmission, with no integrity impact. The decision signals are consistently low-urgency: vuln.today priority is 'this_month' (not act_now/emergency), and SSVC records Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no EPSS score supplied, so widespread or automated exploitation is not indicated. No public exploit was identified - the single reference is an Arm support/documentation page, not a proof-of-concept. One signal conflicts with the mechanism: the input marks AV:N (network), but DHCPv6 is a link-local protocol (clients/servers exchange messages over the local segment via link-local multicast), so realistic exploitation requires an attacker on the same local link (AV:A) rather than arbitrary internet reachability - verify reachability assumptions with the vendor advisory. Net assessment: a genuine but contained defect warranting patching in the normal cycle, not drop-everything escalation.

An attacker positioned on the same local network link as a device running affected MDK-Middleware sends a crafted DHCPv6 message whose option fields are malformed, causing the DHCPv6 option-parsing loop to read beyond the intended buffer. The over-read can leak small amounts of adjacent memory back to the attacker or trigger unintended data retransmission, disrupting the service. No public exploit code is known; the trigger beyond 'option-walk over-read' is not detailed in the available sources.