DHCPv6 processing in Keil MDK-Middleware 8.0.0–8.3.0 contains an over-read due to improper bounds checking when walking through DHCPv6 options (CWE‑125). The flaw permits an attacker to read memory contents beyond the intended buffer. The over-read can then trigger unintended data retransmission, potentially exposing sensitive information or disrupting DHCP traffic.

Affected systems are devices running Keil MDK-Middleware versions 8.0.0 through 8.3.0. This middleware is typically utilized in embedded development environments that handle network configuration. Only these specific major releases are susceptible.

EPSS is not available and the vulnerability is not listed in CISA KEV, indicating no public exploitation evidence to date. The CVSS score is 6.5, reflecting a moderate potential for information disclosure. The inferred attack vector would rely on control of DHCP traffic to the affected device, likely local network access. Without a known exploit, the vulnerability remains a theoretical concern but could be mitigated by patching or disabling DHCPv6 functionality.