U‑Boot released before 2026.10‑rc3 contains an out‑of‑bounds write in the __net_defragment() function of net/net.c when the CONFIG_IP_DEFRAG option is enabled. A remote attacker can send a crafted IP fragment with a non‑zero offset and a More‑Fragments flag during a netboot session, which corrupts adjacent memory and causes the bootloader to crash. The vulnerable code demonstrates a classic buffer overflow (CWE‑787).

The vulnerability applies to all builds of the Denx U‑Boot firmware dated before 2026.10‑rc3 that have CONFIG_IP_DEFRAG enabled. Devices using earlier U‑Boot releases that support netboot and IP fragment reassembly are impacted.

The vulnerability has a CVSS score of 8.8, indicating a high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires remote network access during the boot sequence and an attacker’s ability to inject a specially crafted IP fragment. While it can lead to a denial‑of‑service via bootloader crash, successful exploitation could also allow memory corruption that might be leveraged for further attacks if additional conditions are met.