The vulnerability is an out‑of‑bounds write in the DHCPv6 option parsing routine of U‑Boot that fails to verify the lengths of the SERVERID and CLIENTID options. Injected DHCPv6 packets containing oversized options can corrupt adjacent memory during boot, causing the bootloader to crash. If an attacker can manipulate the corrupted memory region, arbitrary code execution with the privileges of the bootloader may be possible, but the official description indicates a denial‑of‑service outcome rather than confirmed execution.

The flaw exists in any U‑Boot installation that has not yet been updated to the 2026.10‑rc5 release or newer. This includes devices that rely on the open‑source U‑Boot binary from the denx u‑boot repository, any embedded system or industrial controller that uses a local network during a network‑boot sequence, and any hardware that performs DHCPv6 handshakes as part of the boot process.

The CVSS base score of 7.1 indicates a high severity vulnerability with an exploitation potential that requires local network access. The EPSS value is not available, but the absence of a KEV listing suggests there are no widespread public exploits at this time. The likely attack path is a malicious local attacker sending malformed DHCPv6 ADVERTISE or REPLY packets to a target device when it initiates a netboot session. Because the vulnerability is only triggered during the boot process, compromises are limited to devices that immediately attempt DHCPv6 and can be mitigated with network‑level controls.