The vulnerability is an out‑of‑bounds read in the DHCP option parsing logic of barebox, specifically in the dhcp_message_type() function. When a packet lacks the proper end marker, the parser accesses memory beyond the packet bounds, which can result in a crash and, in some configurations, expose unread memory contents. The flaw is a classic off‑by‑one or buffer underrun weakness (CWE‑125).

barebox:barebox is affected. All builds older than version 2026.04.0 contain the unpatched code. Devices that use these earlier barebox releases and receive DHCP traffic are vulnerable.

The CVSS score is 7.1, indicating a high impact threat. EPSS data is unavailable, but the scheduler does not list this vulnerability in KEV. The attack requires the ability to send a crafted DHCP Offer or ACK packet on the same broadcast domain, meaning a local network adversary can exploit the flaw without any privileged access. Successful exploitation would likely cause a denial‑of‑service or, if memory leakage occurs, could provide sensitive information.