barebox versions prior to 2026.04.0 have an out-of-bounds read vulnerability in the DHCP option parsing code. The vulnerability occurs in the dhcp_message_type() function, which does not properly verify that the options pointer stays within the bounds of the received DHCP packet. An attacker on the same broadcast domain can exploit this by sending a crafted DHCP Offer or ACK packet missing the required 0xff end marker, causing the parser to read beyond valid data and potentially crash the system.