---
id: "CVE-2026-124740"
page: "https://infrastack.ai/live/CVE-2026-124740"
kind: "vulnerability"
aliases: ["CVE-2026-124740"]
title: "BusyBox udhcpc6: crafted DHCPv6 reply crashes client or leaks memory"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["busybox", "dhcpv6", "embedded-linux", "infrastructure", "ipv6"]
not_affected_if: ["no-dhcpv6", "no-udhcpc6", "static-ipv6"]
published_at: "2026-11-11T12:19:47+00:00"
first_seen_at: "2026-11-11T12:27:11+00:00"
updated_at: "2026-11-11T12:29:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124740", "first_seen_at": "2026-11-11T12:27:11+00:00"}]
exploit_sources: []
---

# BusyBox udhcpc6: crafted DHCPv6 reply crashes client or leaks memory

Link for people: https://infrastack.ai/live/CVE-2026-124740 (this .md is for agents)

BusyBox's udhcpc6 DHCPv6 client can read freed heap memory when a DHCPv6 reply lacks usable address options. A malicious DHCPv6 server on the local network can crash the client or get previously assigned IPv6 address data disclosed in later requests.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the BusyBox version with `busybox --help` or `busybox | head -1`
- Look for `udhcpc6` on the system, for example with `which udhcpc6` or `ls /sbin/udhcpc6`
- Confirm whether it is used to get IPv6 addresses on a network interface

## Timeline

- 2026-11-11T12:27:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124740

## From the sources

A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by responding with a crafted Dynamic Host Configuration Protocol for IPv6 (DHCPv6) reply packet lacking usable address options. This issue causes the client to read stale heap memory, which can result in a Denial of Service (DoS) due to an application crash or disclose previously assigned network address data in subsequent discovery requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_