{"id":"CVE-2026-124742","kind":"vulnerability","aliases":["CVE-2026-124742"],"related":[],"title":"BusyBox: crafted FAT disk image crashes volume probing utilities","description":"A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations.","summary":"A malformed FAT filesystem can make BusyBox's volume identification code divide by zero and crash. An attacker who can present a crafted storage device or disk image can cause a denial of service that disrupts device discovery and boot.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"busybox","fixed":[],"affected":"","ecosystem":"runtime"}],"ecosystems":["runtime"],"tags":["busybox","embedded-linux","linux","runtime"],"not_affected_if":["no-untrusted-disks"],"how_to_check":"- Check the BusyBox version with `busybox --help` on systems that ship it","fix":null,"status":"open","published_at":"2026-11-11T12:19:47+00:00","first_seen_at":"2026-11-11T12:27:11+00:00","triaged_at":"2026-11-11T12:28:41+00:00","updated_at":"2026-11-11T12:28:41+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-11T12:28:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"BusyBox: crafted FAT disk image crashes volume probing utilities","impact":"low","summary":"A malformed FAT filesystem can make BusyBox's volume identification code divide by zero and crash. An attacker who can present a crafted storage device or disk image can cause a denial of service that disrupts device discovery and boot.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["busybox","embedded-linux","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Volume probing crashes, causing denial of service during device discovery or boot","analyst_note":"Find affected and fixed BusyBox versions and the upstream patch at the linked github.com fix page.","how_to_check":"- Check the BusyBox version with `busybox --help` on systems that ship it\n- Unknown whether the sources list affected version ranges","plain_action":"","product_name":"busybox","needs_analyst":true,"not_affected_if":["no-untrusted-disks"],"who_is_affected":"Systems that run BusyBox utilities such as blkid or mdev and automatically probe attached storage or disk images, typically embedded devices and minimal Linux images. Systems that never scan untrusted disks or images are unlikely to be reached. The sources do not list affected versions.","user_interaction":"unknown","product_ecosystem":"runtime","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00072,"input_tokens":4590,"output_tokens":521,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124742':12A,15A '-2026':11A,14A 'abl':87C 'analyz':80C 'attack':40B,86C 'boot':62B,135C 'busybox':1A,16A,17B,29B,68C 'caus':52B,114C 'cluster':77C 'code':33B 'compon':72C 'condit':104C 'craft':2A,45B,91C 'crash':6A,38B,119C 'cve':10A,13A 'denial':54B,124C 'devic':47B,59B,93C,131C 'discoveri':60B,132C 'disk':4A,49B,95C 'disrupt':58B,130C 'divid':34B,101C 'divide-by-zero':100C 'dos':127C 'embed':19B 'embedded-linux':18B 'fail':73C 'fat':3A,25B,83C 'filesystem':26B,84C 'flaw':64C 'format':82C 'found':66C 'identif':32B,71C 'imag':5A,50B,96C 'inspect':109C 'issu':113C 'linux':20B,21B 'make':28B 'malform':24B 'oper':136C 'paramet':78C 'partit':106C 'present':43B,89C 'probe':8A,116C 'proper':75C 'result':121C 'runtim':22B 'scan':107C 'servic':56B,126C 'special':81C 'storag':46B,92C 'system':134C 'trigger':98C 'unexpect':120C 'util':9A,108C,117C 'valid':76C 'volum':7A,31B,70C,111C 'zero':36B,103C","nicknames":[],"mitigations":[],"who_affected":"Systems that run BusyBox utilities such as blkid or mdev and automatically probe attached storage or disk images, typically embedded devices and minimal Linux images. Systems that never scan untrusted disks or images are unlikely to be reached. The sources do not list affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["busybox"],"ptokens":["busybox"],"labels":["busybox","embeddedlinux","linux","medium","runtime"],"campaign_type":null,"search_a":"'-124742':12A,15A '-2026':11A,14A 'busybox':1A,16A 'craft':2A 'crash':6A 'cve':10A,13A 'disk':4A 'fat':3A 'imag':5A 'probe':8A 'util':9A 'volum':7A","search_b":"'attack':40B 'boot':62B 'busybox':17B,29B 'caus':52B 'code':33B 'craft':45B 'crash':38B 'denial':54B 'devic':47B,59B 'discoveri':60B 'disk':49B 'disrupt':58B 'divid':34B 'embed':19B 'embedded-linux':18B 'fat':25B 'filesystem':26B 'identif':32B 'imag':50B 'linux':20B,21B 'make':28B 'malform':24B 'present':43B 'runtim':22B 'servic':56B 'storag':46B 'volum':31B 'zero':36B","search_c":"'abl':87C 'analyz':80C 'attack':86C 'boot':135C 'busybox':68C 'caus':114C 'cluster':77C 'compon':72C 'condit':104C 'craft':91C 'crash':119C 'denial':124C 'devic':93C,131C 'discoveri':132C 'disk':95C 'disrupt':130C 'divid':101C 'divide-by-zero':100C 'dos':127C 'fail':73C 'fat':83C 'filesystem':84C 'flaw':64C 'format':82C 'found':66C 'identif':71C 'imag':96C 'inspect':109C 'issu':113C 'oper':136C 'paramet':78C 'partit':106C 'present':89C 'probe':116C 'proper':75C 'result':121C 'scan':107C 'servic':126C 'special':81C 'storag':92C 'system':134C 'trigger':98C 'unexpect':120C 'util':108C,117C 'valid':76C 'volum':70C,111C 'zero':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124742","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124742","severity":null,"published_at":"2026-11-11T12:19:47+00:00","modified_at":"2026-11-11T12:19:47+00:00","first_seen_at":"2026-11-11T12:27:11+00:00","fetched_at":"2026-11-11T12:27:11+00:00","note":null}],"documents":[{"id":125351,"url":"https://github.com/vda-linux/busybox_mirror/commit/b7c89c4","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}