The vulnerability is an out-of-bounds read (CWE-125) in the U‑Boot bootloader’s tcp_rx_state_machine() routine, triggered when CONFIG_PROT_TCP is enabled. A malicious packet that mismatches the IP total length with a TCP data offset causes tcp_parse_options() to read past the end of the TCP segment, potentially corrupting connection‑state variables such as rmt_win_scale and rmt_timestamp. This corruption can disrupt TCP window calculations, leading to failed networking or denial of service for affected TCP sessions.

All versions of U‑Boot released up to and including 2026.04‑rc3 are affected when the CONFIG_PROT_TCP option is enabled. The vendor is u‑boot, and the product is the U‑Boot bootloader.

The CVSS score of 6.9 indicates moderate severity, while an EPSS score of less than 1% reflects a low but non‑zero exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the flaw remotely by sending a crafted TCP packet to the device’s network interface; authentication is not required, and a simple IP or TCP connection suffices to deliver the malicious payload.