{"id":"CVE-2026-124741","kind":"vulnerability","aliases":["CVE-2026-124741"],"related":[],"title":"BusyBox udhcpc6: oversized DHCPv6 server options overflow the stack on Renew/Release","description":"A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, triggering a stack-based buffer overflow. This vulnerability could allow an attacker to achieve arbitrary code execution with root privileges or cause a denial of service (DoS) crash.","summary":"Per Red Hat's bug report, udhcpc6 stores the server's SERVERID, IA_NA and IA_PD options as received and later copies them, with the client's own options, into a fixed-size stack struct d6_packet with no size check. A rogue DHCPv6 server on the link can send a Reply that makes the next Renew write 34 bytes past the buffer (Release: 20), with partly server-controlled content. udhcpc6 runs as root; the result is a crash and possibly code execution. No exploitation or public PoC found.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["busybox","dhcpv6","embedded-linux","infrastructure","linux-appliances","udhcpc6"],"not_affected_if":["networkmanager-dhcp","no-dhcpv6-client","static-ipv6"],"how_to_check":"Run 'busybox --list | grep udhcpc6' (or check CONFIG_UDHCPC6=y in the build config) on each device. Then see whether the interface gets IPv6 via DHCPv6 (a udhcpc6 process, or 'udhcpc6' in init/network scripts). BusyBox version: 'busybox | head -1'. No affected or fixed release number is published yet.","fix":null,"status":"open","published_at":"2026-11-11T11:17:17+00:00","first_seen_at":"2026-11-11T11:26:56+00:00","triaged_at":"2026-11-11T11:27:33+00:00","updated_at":"2026-11-11T11:28:20+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T11:27:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"BusyBox: udhcpc6 stack overflow lets a rogue DHCPv6 server run code","impact":"high","summary":"The udhcpc6 DHCPv6 client in BusyBox copies server-supplied network options into memory without checking their size. A malicious DHCPv6 server on the local network can send a crafted reply that overflows the stack, which can run code as root or crash the client.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["busybox","embedded-linux","dhcpv6","linux-appliances"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs as root on the client, or the client crashes","analyst_note":"Find the affected and fixed BusyBox versions and the upstream commit for the udhcpc6 fix (check the NVD entry and the BusyBox project).","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-dhcpv6-client","static-ipv6"],"who_is_affected":"Systems running BusyBox with the udhcpc6 DHCPv6 client enabled are exposed, since the flaw is triggered by a DHCPv6 reply from a server on the local network. Hosts that use static IPv6 configuration, or do not run udhcpc6, can skip it. The sources do not say which BusyBox versions are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000724,"input_tokens":4575,"output_tokens":532,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed BusyBox versions and the upstream commit for the udhcpc6 fix (check the NVD entry and the BusyBox project).","search":"'-124741':14A,17A '-2026':13A,16A '20':94B '34':88B 'achiev':179C 'allow':175C 'applianc':26B 'arbitrari':180C 'attack':177C 'base':169C 'buffer':92B,170C 'bug':32B 'busybox':1A,18B,125C 'byte':89B 'caus':187C 'check':70B 'client':54B,129C 'code':112B,181C 'content':100B 'control':99B 'copi':50B,144C 'could':174C 'craft':163C 'crash':109B,193C 'cve':12A,15A 'd6':65B 'denial':189C 'dhcpv6':4A,19B,73B,128C,150C 'dos':192C 'embed':21B 'embedded-linux':20B 'execut':113B,182C 'exploit':115B,157C 'fix':61B 'fixed-s':60B 'flaw':121C,159C 'found':119B,123C 'hat':30B 'ia':40B,43B 'infrastructur':23B 'later':49B 'link':77B 'linux':22B,25B 'linux-appli':24B 'local':154C 'make':83B 'malici':149C 'memori':147C 'na':41B 'network':137C,155C 'next':85B 'option':6A,45B,57B,138C 'overflow':7A,171C 'overs':3A 'packet':66B 'part':96B 'past':90B 'pd':44B 'per':28B 'poc':118B 'possibl':111B 'privileg':185C 'proper':132C 'public':117B 'receiv':47B 'red':29B 'releas':93B 'renew':86B 'renew/release':11A 'repli':81B,164C 'report':33B 'result':106B 'rogu':72B 'root':104B,184C 'run':102B 'send':79B,161C 'sent':139C 'server':5A,37B,74B,98B,142C,151C 'server-control':97B 'serverid':39B 'servic':191C 'size':62B,69B,135C 'stack':9A,63B,168C 'stack-bas':167C 'store':35B 'struct':64B 'trigger':165C 'udhcpc6':2A,27B,34B,101B,127C 'valid':133C 'vulner':173C 'write':87B","nicknames":[],"mitigations":[],"who_affected":"Embedded and appliance systems (routers, containers, Alpine-style images) that ship BusyBox with udhcpc6 enabled and use it to get IPv6 settings are exposed to a rogue DHCPv6 server on the same network link. Red Hat says standard RHEL does not use BusyBox for DHCP (NetworkManager does), and lists RHEL 6 as unaffected and Red Hat Hardened Images as affected. Systems with static IPv6, or without udhcpc6, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["busybox","dhcpv6","embeddedlinux","high","infrastructure","linuxappliances","udhcpc6"],"campaign_type":null,"search_a":"'-124741':14A,17A '-2026':13A,16A 'busybox':1A 'cve':12A,15A 'dhcpv6':4A 'option':6A 'overflow':7A 'overs':3A 'renew/release':11A 'server':5A 'stack':9A 'udhcpc6':2A","search_b":"'20':94B '34':88B 'applianc':26B 'buffer':92B 'bug':32B 'busybox':18B 'byte':89B 'check':70B 'client':54B 'code':112B 'content':100B 'control':99B 'copi':50B 'crash':109B 'd6':65B 'dhcpv6':19B,73B 'embed':21B 'embedded-linux':20B 'execut':113B 'exploit':115B 'fix':61B 'fixed-s':60B 'found':119B 'hat':30B 'ia':40B,43B 'infrastructur':23B 'later':49B 'link':77B 'linux':22B,25B 'linux-appli':24B 'make':83B 'na':41B 'next':85B 'option':45B,57B 'packet':66B 'part':96B 'past':90B 'pd':44B 'per':28B 'poc':118B 'possibl':111B 'public':117B 'receiv':47B 'red':29B 'releas':93B 'renew':86B 'repli':81B 'report':33B 'result':106B 'rogu':72B 'root':104B 'run':102B 'send':79B 'server':37B,74B,98B 'server-control':97B 'serverid':39B 'size':62B,69B 'stack':63B 'store':35B 'struct':64B 'udhcpc6':27B,34B,101B 'write':87B","search_c":"'achiev':179C 'allow':175C 'arbitrari':180C 'attack':177C 'base':169C 'buffer':170C 'busybox':125C 'caus':187C 'client':129C 'code':181C 'copi':144C 'could':174C 'craft':163C 'crash':193C 'denial':189C 'dhcpv6':128C,150C 'dos':192C 'execut':182C 'exploit':157C 'flaw':121C,159C 'found':123C 'local':154C 'malici':149C 'memori':147C 'network':137C,155C 'option':138C 'overflow':171C 'privileg':185C 'proper':132C 'repli':164C 'root':184C 'send':161C 'sent':139C 'server':142C,151C 'servic':191C 'size':135C 'stack':168C 'stack-bas':167C 'trigger':165C 'udhcpc6':127C 'valid':133C 'vulner':173C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T11:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124741","severity":null,"published_at":"2026-11-11T11:17:17+00:00","modified_at":"2026-11-11T11:17:17+00:00","first_seen_at":"2026-11-11T11:26:56+00:00","fetched_at":"2026-11-11T11:26:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124741:3539","url":"https://access.redhat.com/security/cve/CVE-2026-124741","severity":null,"published_at":"2026-11-11T11:28:20+00:00","modified_at":"2026-11-11T11:28:20+00:00","first_seen_at":"2026-11-11T11:28:20+00:00","fetched_at":"2026-11-11T11:28:20+00:00","note":"Red Hat CVE page and Bugzilla 2571617 read; no upstream version range or fixed release published. A 2026-08-15 busybox list patch 'udhcpc6: bound DHCPv6 packet construction' covers the Renew/Release paths, but I could not confirm it was merged or tied to this CVE, so no fix claimed. The 42202bf commit belongs to CVE-2026-29004 (a different heap bug). Search of git.busybox.net log failed (404). X not checked. Nothing verified.","cites":["https://access.redhat.com/security/cve/CVE-2026-124741","https://bugzilla.redhat.com/show_bug.cgi?id=2571617","https://lists.busybox.net/pipermail/busybox/2026-August/092416.html"]}],"documents":[{"id":125067,"url":"https://access.redhat.com/security/cve/CVE-2026-124741","title":"Red Hat CVE-2026-124741","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":125068,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571617","title":"Bug 2571617: busybox udhcpc6 send_d6_renew/send_d6_release stack overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":125070,"url":"https://lists.busybox.net/pipermail/busybox/2026-August/092416.html","title":"[PATCH] udhcpc6: bound DHCPv6 packet construction (proposed, not confirmed merged)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}