---
id: "CVE-2026-124737"
page: "https://infrastack.ai/live/CVE-2026-124737"
kind: "vulnerability"
aliases: ["CVE-2026-124737"]
title: "BusyBox: TFTP client heap overflow lets a malicious server run code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["busybox", "embedded", "infrastructure", "iot", "linux", "tftp"]
not_affected_if: ["blocksize-feature-disabled", "no-tftp-client", "tftp-without--b-option", "trusted-tftp-server-only"]
published_at: "2026-11-11T10:16:43+00:00"
first_seen_at: "2026-11-11T10:26:48+00:00"
updated_at: "2026-11-11T10:27:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124737", "first_seen_at": "2026-11-11T10:26:48+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124737", "first_seen_at": "2026-11-11T10:27:37+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-124737", "https://lists.busybox.net/pipermail/busybox/2026-September/092488.html"]}]
exploit_sources: []
---

# BusyBox: TFTP client heap overflow lets a malicious server run code

Link for people: https://infrastack.ai/live/CVE-2026-124737 (this .md is for agents)

BusyBox's tftp client allocates blksize+4 bytes when run with -b below 512. If the server ignores the option, the client falls back to 512-byte blocks without resizing, so a server-sent packet can write past the heap buffer (crash, possibly code execution).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

1. Is the applet present: busybox --list | grep tftp (tftpd is a different applet and not described as affected).
2. Search scripts/init/firmware for 'tftp' calls using -b with a value under 512, e.g. grep -rE 'tftp .*-b *[0-9]+' . Only that case is described as vulnerable.
3. Check the version with busybox | head -1; affected range is not published, so treat all current builds with FEATURE_TFTP_BLOCKSIZE as possibly affected until your vendor says otherwise.

## Fix

No released fix confirmed. A patch was posted to the BusyBox list (sizes io_bufsize to at least 512+4 in networking/tftp.c); apply it or build from a BusyBox commit that contains it. Check your distro for a backport.

## Timeline

- 2026-11-11T10:26:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124737
- 2026-11-11T10:27:37+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-124737 — Root cause read in the busybox-list patch (Sep 19 2026, networking/tftp.c): only reachable when tftp is run with -b <512 and the server ignores blksize (no OACK). No released fixed version found; patch upstream-proposed, merge status unconfirmed. NVD page has no text; versions unknown.

## Documents

- [describes] NVD CVE-2026-124737 https://nvd.nist.gov/vuln/detail/CVE-2026-124737
- [fix] [PATCH] tftp: don't overflow the receive buffer after blocksize fallback https://lists.busybox.net/pipermail/busybox/2026-September/092488.html

## From the sources

A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing the application.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_