CVE-2026-124737 · Infrastructure
NO FIX YET · SEE WHAT TO DO
BusyBox's tftp client allocates blksize+4 bytes when run with -b below 512. If the server ignores the option, the client falls back to 512-byte blocks without resizing, so a server-sent packet can write past the heap buffer (crash, possibly code execution).
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run the BusyBox TFTP client to fetch files from a TFTP server, such as embedded devices, routers, and minimal Linux images, are exposed when the server can be attacker-controlled or spoofed. Systems that do not use the TFTP client, or only talk to trusted TFTP servers on isolated networks, are much less exposed. The sources do not name the affected BusyBox versions.
Not affected if blocksize-feature-disabled, no-tftp-client, tftp-without--b-option, trusted-tftp-server-only
Who cares busybox, embedded, iot, linux, tftp
Posts are quoted with a link to the original. They are data to us, never instructions.
A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing the application.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.