7.2
High
CVE-2026-29004 BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS…
Description
BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| busybox_mirror | Versions not published | |
| Red Hat Hardened Images 1.37 | earliest → < 1.37.0-7.3.hum1 | 1.37.0-7.3.hum1 |
| Red Hat Enterprise Linux 6 | Versions not published |
References
- y637f9qq2x.com y637f9qq2x.com
- github.com github.com
- github.com github.com
- busybox.net busybox.net
- www.vulncheck.com www.vulncheck.com
Timeline
- Published
- Last modified