{"id":"CVE-2026-124737","kind":"vulnerability","aliases":["CVE-2026-124737"],"related":[],"title":"BusyBox: TFTP client heap overflow lets a malicious server run code","description":"A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing the application.","summary":"BusyBox's tftp client allocates blksize+4 bytes when run with -b below 512. If the server ignores the option, the client falls back to 512-byte blocks without resizing, so a server-sent packet can write past the heap buffer (crash, possibly code execution).","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["busybox","embedded","infrastructure","iot","linux","tftp"],"not_affected_if":["blocksize-feature-disabled","no-tftp-client","tftp-without--b-option","trusted-tftp-server-only"],"how_to_check":"1. Is the applet present: busybox --list | grep tftp (tftpd is a different applet and not described as affected).\n2. Search scripts/init/firmware for 'tftp' calls using -b with a value under 512, e.g. grep -rE 'tftp .*-b *[0-9]+' . Only that case is described as vulnerable.\n3. Check the version with busybox | head -1; affected range is not published, so treat all current builds with FEATURE_TFTP_BLOCKSIZE as possibly affected until your vendor says otherwise.","fix":"No released fix confirmed. A patch was posted to the BusyBox list (sizes io_bufsize to at least 512+4 in networking/tftp.c); apply it or build from a BusyBox commit that contains it. Check your distro for a backport.","status":"open","published_at":"2026-11-11T10:16:43+00:00","first_seen_at":"2026-11-11T10:26:48+00:00","triaged_at":"2026-11-11T10:27:01+00:00","updated_at":"2026-11-11T10:27:37+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-11T10:27:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"BusyBox: TFTP client heap overflow lets a malicious server run code","impact":"high","summary":"BusyBox's TFTP client allocates a buffer for a custom small block size, then falls back to the default block size without resizing it when the server replies normally. A malicious TFTP server can send standard-sized packets during a transfer to overflow the heap, letting an attacker run code or crash the client.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["busybox","embedded","linux","tftp"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker-controlled TFTP server runs code on the client","analyst_note":"Confirm affected BusyBox version range and fixed release from NVD or the BusyBox project; sources give no versions or fix.","how_to_check":"- Check whether BusyBox is installed with the TFTP client applet: `busybox --list | grep tftp`\n- Look for scripts or devices that run `busybox tftp` or `tftp` against servers you do not control\n- Check the BusyBox version: `busybox --help` (the first line shows the version)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-tftp-client","trusted-tftp-server-only"],"who_is_affected":"Systems that run the BusyBox TFTP client to fetch files from a TFTP server, such as embedded devices, routers, and minimal Linux images, are exposed when the server can be attacker-controlled or spoofed. Systems that do not use the TFTP client, or only talk to trusted TFTP servers on isolated networks, are much less exposed. The sources do not name the affected BusyBox versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000775,"input_tokens":4590,"output_tokens":631,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected BusyBox version range and fixed release from NVD or the BusyBox project; sources give no versions or fix.","search":"'+4':30B '-124737':14A,17A '-2026':13A,16A '512':37B,49B 'achiev':138C 'alloc':28B,106C 'allow':134C 'applic':152C 'arbitrari':139C 'attack':136C 'b':35B 'back':47B,97C 'blksize':29B 'block':51B,88C,101C 'buffer':65B,108C,130C 'busybox':1A,18B,24B,75C 'byte':31B,50B 'caus':127C,143C 'client':3A,27B,45B,83C 'code':11A,68B,140C 'crash':66B,150C 'custom':86C 'cve':12A,15A 'default':100C 'denial':145C 'dos':148C 'embed':19B 'execut':69B,141C 'exploit':114C 'fall':46B,96C 'file':80C 'flaw':71C,133C 'found':73C 'heap':4A,64B,129C 'ignor':41B 'infrastructur':20B 'iot':21B 'issu':116C 'let':6A 'linux':22B 'malici':8A,110C 'memori':107C 'network':122C 'option':43B 'overflow':5A,131C 'packet':59B,123C 'past':62B 'possibl':67B 'protocol':82C 'receiv':91C 'request':84C 'resiz':53B,104C 'respons':94C 'run':10A,33B 'send':118C 'sent':58B 'server':9A,40B,57B,112C 'server-s':56B 'servic':147C 'size':89C,102C,121C 'small':87C 'standard':93C,120C 'standard-s':119C 'tftp':2A,23B,26B,78C,111C 'transfer':81C,126C 'trivial':79C 'without':52B,103C 'write':61B","nicknames":[],"mitigations":[],"who_affected":"Systems that run the BusyBox TFTP client to fetch files from a TFTP server, such as embedded devices, routers, and minimal Linux images, are exposed when the server can be attacker-controlled or spoofed. Systems that do not use the TFTP client, or only talk to trusted TFTP servers on isolated networks, are much less exposed. The sources do not name the affected BusyBox versions.","tier":"B","verified":{"fix":{"at":"2026-11-11T10:27:37Z","by":"analyst","doc":"https://lists.busybox.net/pipermail/busybox/2026-September/092488.html","run_id":3534}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["busybox","embedded","high","infrastructure","iot","linux","tftp"],"campaign_type":null,"search_a":"'-124737':14A,17A '-2026':13A,16A 'busybox':1A 'client':3A 'code':11A 'cve':12A,15A 'heap':4A 'let':6A 'malici':8A 'overflow':5A 'run':10A 'server':9A 'tftp':2A","search_b":"'+4':30B '512':37B,49B 'alloc':28B 'b':35B 'back':47B 'blksize':29B 'block':51B 'buffer':65B 'busybox':18B,24B 'byte':31B,50B 'client':27B,45B 'code':68B 'crash':66B 'embed':19B 'execut':69B 'fall':46B 'heap':64B 'ignor':41B 'infrastructur':20B 'iot':21B 'linux':22B 'option':43B 'packet':59B 'past':62B 'possibl':67B 'resiz':53B 'run':33B 'sent':58B 'server':40B,57B 'server-s':56B 'tftp':23B,26B 'without':52B 'write':61B","search_c":"'achiev':138C 'alloc':106C 'allow':134C 'applic':152C 'arbitrari':139C 'attack':136C 'back':97C 'block':88C,101C 'buffer':108C,130C 'busybox':75C 'caus':127C,143C 'client':83C 'code':140C 'crash':150C 'custom':86C 'default':100C 'denial':145C 'dos':148C 'execut':141C 'exploit':114C 'fall':96C 'file':80C 'flaw':71C,133C 'found':73C 'heap':129C 'issu':116C 'malici':110C 'memori':107C 'network':122C 'overflow':131C 'packet':123C 'protocol':82C 'receiv':91C 'request':84C 'resiz':104C 'respons':94C 'send':118C 'server':112C 'servic':147C 'size':89C,102C,121C 'small':87C 'standard':93C,120C 'standard-s':119C 'tftp':78C,111C 'transfer':81C,126C 'trivial':79C 'without':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T10:16:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124737","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124737","severity":null,"published_at":"2026-11-11T10:16:43+00:00","modified_at":"2026-11-11T10:16:43+00:00","first_seen_at":"2026-11-11T10:26:48+00:00","fetched_at":"2026-11-11T10:26:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124737:3534","url":"https://lists.busybox.net/pipermail/busybox/2026-September/092488.html","severity":null,"published_at":"2026-11-11T10:27:37+00:00","modified_at":"2026-11-11T10:27:37+00:00","first_seen_at":"2026-11-11T10:27:37+00:00","fetched_at":"2026-11-11T10:27:37+00:00","note":"Root cause read in the busybox-list patch (Sep 19 2026, networking/tftp.c): only reachable when tftp is run with -b <512 and the server ignores blksize (no OACK). No released fixed version found; patch upstream-proposed, merge status unconfirmed. NVD page has no text; versions unknown.","cites":["https://lists.busybox.net/pipermail/busybox/2026-September/092488.html","https://nvd.nist.gov/vuln/detail/CVE-2026-124737"]}],"documents":[{"id":124708,"url":"https://lists.busybox.net/pipermail/busybox/2026-September/092488.html","title":"[PATCH] tftp: don't overflow the receive buffer after blocksize fallback","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":124710,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124737","title":"NVD CVE-2026-124737","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}