U-Boot versions prior to 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contain an out-of-bounds write vulnerability in the __net_defragment() function. This vulnerability allows remote attackers to send crafted IP fragments during netboot, potentially corrupting adjacent memory and causing the bootloader to crash. The vulnerability has a CVSS score of 8.2, indicating a medium severity level. A patch is available to address this issue.