{"id":"CVE-2026-124746","kind":"vulnerability","aliases":["CVE-2026-124746"],"related":[],"title":"BusyBox: crafted filesystem image crashes blkid, findfs and mount","description":"A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.","summary":"An integer overflow in BusyBox's volume_id code, used when probing filesystem metadata, can be triggered by a specially crafted filesystem image on an attached storage device. Successful exploitation crashes utilities such as blkid, findfs or mount, denying service by preventing storage devices from being resolved or mounted.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"busybox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["busybox","embedded-linux","infrastructure","linux"],"not_affected_if":["glibc-utilities-only","no-untrusted-storage"],"how_to_check":"- Check the BusyBox version with `busybox --help` or `busybox | head -1` on systems that ship it.\n- Confirm whether `blkid`, `findfs` or `mount` on the system are provided by BusyBox (for example `ls -l $(which blkid)`).","fix":null,"status":"open","published_at":"2026-11-11T15:17:19+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","triaged_at":"2026-11-11T15:29:49+00:00","updated_at":"2026-11-11T15:29:49+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-11T15:29:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"BusyBox: crafted filesystem image crashes blkid, findfs and mount","impact":"low","summary":"An integer overflow in BusyBox's volume_id code, used when probing filesystem metadata, can be triggered by a specially crafted filesystem image on an attached storage device. Successful exploitation crashes utilities such as blkid, findfs or mount, denying service by preventing storage devices from being resolved or mounted.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["busybox","embedded-linux","linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Storage device probing crashes, denying service to mounting","analyst_note":"Find the affected and fixed BusyBox versions for CVE-2026-124746 at https://nvd.nist.gov/vuln/detail/CVE-2026-124746 or the upstream BusyBox project.","how_to_check":"- Check the BusyBox version with `busybox --help` or `busybox | head -1` on systems that ship it.\n- Confirm whether `blkid`, `findfs` or `mount` on the system are provided by BusyBox (for example `ls -l $(which blkid)`).","plain_action":"","product_name":"busybox","needs_analyst":true,"not_affected_if":["no-untrusted-storage","glibc-utilities-only"],"who_is_affected":"Systems that run BusyBox utilities blkid, findfs or mount and that mount or probe storage devices that could carry untrusted filesystem images, such as removable media or attached disks. Systems that do not probe untrusted storage, or that use other implementations of these tools, can likely skip it. The sources do not give affected version ranges.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000787,"input_tokens":4577,"output_tokens":659,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124746':12A,15A '-2026':11A,14A 'applic':124C 'attach':48B,110C 'attack':96C 'blkid':6A,57B,119C 'boundari':90C 'buffer':89C 'busybox':1A,16A,17B,27B,77C 'calcul':88C 'code':31B 'compon':86C 'craft':2A,43B,105C 'crash':5A,53B,125C 'cve':10A,13A 'deni':61B 'denial':129C 'devic':50B,66B,112C,142C 'dos':132C 'embed':19B 'embedded-linux':18B 'exploit':52B,98C 'filesystem':3A,35B,44B,93C,106C 'findf':7A,58B,120C 'flaw':73C 'found':75C 'id':30B,85C 'imag':4A,45B,107C 'infrastructur':21B 'integ':24B,79C 'linux':20B,22B 'metadata':36B,94C 'mount':9A,60B,71B,122C,140C 'occur':81C 'overflow':25B,80C 'prevent':64B,134C 'probe':34B,92C,114C 'provid':102C 'resolv':69B,138C 'result':126C 'servic':62B,131C 'special':42B,104C 'storag':49B,65B,111C,141C 'success':51B 'system':136C 'trigger':39B 'use':32B 'util':54B,116C 'volum':29B,84C 'vulner':100C","nicknames":[],"mitigations":[],"who_affected":"Systems that run BusyBox utilities blkid, findfs or mount and that mount or probe storage devices that could carry untrusted filesystem images, such as removable media or attached disks. Systems that do not probe untrusted storage, or that use other implementations of these tools, can likely skip it. The sources do not give affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["busybox"],"ptokens":["busybox"],"labels":["busybox","embeddedlinux","infrastructure","linux","medium","vendor"],"campaign_type":null,"search_a":"'-124746':12A,15A '-2026':11A,14A 'blkid':6A 'busybox':1A,16A 'craft':2A 'crash':5A 'cve':10A,13A 'filesystem':3A 'findf':7A 'imag':4A 'mount':9A","search_b":"'attach':48B 'blkid':57B 'busybox':17B,27B 'code':31B 'craft':43B 'crash':53B 'deni':61B 'devic':50B,66B 'embed':19B 'embedded-linux':18B 'exploit':52B 'filesystem':35B,44B 'findf':58B 'id':30B 'imag':45B 'infrastructur':21B 'integ':24B 'linux':20B,22B 'metadata':36B 'mount':60B,71B 'overflow':25B 'prevent':64B 'probe':34B 'resolv':69B 'servic':62B 'special':42B 'storag':49B,65B 'success':51B 'trigger':39B 'use':32B 'util':54B 'volum':29B","search_c":"'applic':124C 'attach':110C 'attack':96C 'blkid':119C 'boundari':90C 'buffer':89C 'busybox':77C 'calcul':88C 'compon':86C 'craft':105C 'crash':125C 'denial':129C 'devic':112C,142C 'dos':132C 'exploit':98C 'filesystem':93C,106C 'findf':120C 'flaw':73C 'found':75C 'id':85C 'imag':107C 'integ':79C 'metadata':94C 'mount':122C,140C 'occur':81C 'overflow':80C 'prevent':134C 'probe':92C,114C 'provid':102C 'resolv':138C 'result':126C 'servic':131C 'special':104C 'storag':111C,141C 'system':136C 'util':116C 'volum':84C 'vulner':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124746","severity":null,"published_at":"2026-11-11T15:17:19+00:00","modified_at":"2026-11-11T15:17:19+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","fetched_at":"2026-11-11T15:27:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}