{"id":"CVE-2026-124747","kind":"vulnerability","aliases":["CVE-2026-124747"],"related":[],"title":"BusyBox wget: crafted FTP file size enables heap overflow and code execution","description":"A flaw was found in BusyBox. When resuming a download over File Transfer Protocol (FTP), the wget utility fails to verify that the resume offset does not exceed the file size reported by the server, resulting in an integer calculation error. A malicious FTP server or an on-path network attacker can exploit this issue by returning crafted file size metadata, triggering a heap-based buffer overflow with attacker-controlled data. Successful exploitation may allow an attacker to execute arbitrary code or crash the application, resulting in a denial of service (DoS).","summary":"When resuming an FTP download, BusyBox wget does not check that the resume offset is within the file size the server reports. A malicious FTP server or an on-path attacker can send crafted size data that causes a heap buffer overflow, which may allow arbitrary code execution or a crash.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"busybox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["busybox","embedded","ftp","infrastructure","linux","wget"],"not_affected_if":["busybox-not-used","gnu-wget","https-only","no-ftp-downloads"],"how_to_check":"- Run `busybox | head -1` to see the BusyBox version, and `ls -l $(which wget)` to see whether wget is a BusyBox link.\n- Look for scripts or images that run `wget -c` against ftp:// URLs.\n- No affected or fixed versions are published in Red Hat's CVE page or Bugzilla; check the BusyBox git log and your distro's tracker for a fix.","fix":null,"status":"open","published_at":"2026-11-10T13:18:22+00:00","first_seen_at":"2026-11-10T13:22:03+00:00","triaged_at":"2026-11-10T13:23:31+00:00","updated_at":"2026-11-10T13:25:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T13:23:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"BusyBox wget: crafted FTP file size enables heap overflow and code execution","impact":"high","summary":"When resuming an FTP download, BusyBox wget does not check that the resume offset is within the file size the server reports. A malicious FTP server or an on-path attacker can send crafted size data that causes a heap buffer overflow, which may allow arbitrary code execution or a crash.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["busybox","wget","ftp","embedded","linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker-controlled data overwrites heap memory, possibly running code","analyst_note":"Find the affected and fixed BusyBox versions and the upstream patch in the NVD entry or the BusyBox project's advisories; the sources here give none.","how_to_check":"- Run `busybox --help` on the host to see whether BusyBox is installed and which version it reports.\n- Check whether `wget` on the system is provided by BusyBox (for example `ls -l $(which wget)` pointing to a BusyBox binary).\n- Look for scripts or tools that run `wget` against FTP URLs with resume (`-c`) enabled.","plain_action":"","product_name":"busybox","needs_analyst":true,"not_affected_if":["no-ftp-downloads","https-only","busybox-not-used"],"who_is_affected":"Systems running BusyBox wget that download files over FTP with resume enabled, particularly where the FTP server or the network path is not fully trusted. Systems that do not use BusyBox wget for FTP downloads, or that use only HTTP/HTTPS, are less exposed. The sources do not list affected versions.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000791,"input_tokens":4606,"output_tokens":661,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed BusyBox versions and the upstream patch in the NVD entry or the BusyBox project's advisories; the sources here give none.","search":"'-124747':15A,18A '-2026':14A,17A 'allow':71B,155C 'applic':165C 'arbitrari':72B,160C 'attack':57B,129C,149C,157C 'attacker-control':148C 'base':144C 'buffer':67B,145C 'busybox':1A,19A,20B,31B,83C 'calcul':117C 'caus':64B 'check':35B 'code':11A,73B,161C 'control':150C 'craft':3A,60B,136C 'crash':77B,163C 'cve':13A,16A 'data':62B,151C 'denial':169C 'dos':172C 'download':30B,87C 'embed':21B 'enabl':7A 'error':118C 'exceed':105C 'execut':12A,74B,159C 'exploit':131C,153C 'fail':96C 'file':5A,43B,89C,107C,137C 'flaw':79C 'found':81C 'ftp':4A,22B,29B,50B,92C,121C 'heap':8A,66B,143C 'heap-bas':142C 'infrastructur':23B 'integ':116C 'issu':133C 'linux':24B 'malici':49B,120C 'may':70B,154C 'metadata':139C 'network':128C 'offset':39B,102C 'on-path':54B,125C 'overflow':9A,68B,146C 'path':56B,127C 'protocol':91C 'report':47B,109C 'result':113C,166C 'resum':27B,38B,85C,101C 'return':135C 'send':59B 'server':46B,51B,112C,122C 'servic':171C 'size':6A,44B,61B,108C,138C 'success':152C 'transfer':90C 'trigger':140C 'util':95C 'verifi':98C 'wget':2A,25B,32B,94C 'within':41B","nicknames":[],"mitigations":[],"who_affected":"Systems where wget is the BusyBox applet (with FTP support compiled in) and is used to resume (-c) FTP downloads from a server or network path that is not trusted. Red Hat says BusyBox is mostly limited to minimal container and boot images in its products; embedded devices and Alpine/BusyBox-based containers are the usual places to look. Skip it if wget is GNU wget, FTP is not used, or downloads use HTTPS only. Affected and fixed versions are not published yet.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["busybox"],"ptokens":["busybox"],"labels":["busybox","embedded","ftp","high","infrastructure","linux","vendor","wget"],"campaign_type":null,"search_a":"'-124747':15A,18A '-2026':14A,17A 'busybox':1A,19A 'code':11A 'craft':3A 'cve':13A,16A 'enabl':7A 'execut':12A 'file':5A 'ftp':4A 'heap':8A 'overflow':9A 'size':6A 'wget':2A","search_b":"'allow':71B 'arbitrari':72B 'attack':57B 'buffer':67B 'busybox':20B,31B 'caus':64B 'check':35B 'code':73B 'craft':60B 'crash':77B 'data':62B 'download':30B 'embed':21B 'execut':74B 'file':43B 'ftp':22B,29B,50B 'heap':66B 'infrastructur':23B 'linux':24B 'malici':49B 'may':70B 'offset':39B 'on-path':54B 'overflow':68B 'path':56B 'report':47B 'resum':27B,38B 'send':59B 'server':46B,51B 'size':44B,61B 'wget':25B,32B 'within':41B","search_c":"'allow':155C 'applic':165C 'arbitrari':160C 'attack':129C,149C,157C 'attacker-control':148C 'base':144C 'buffer':145C 'busybox':83C 'calcul':117C 'code':161C 'control':150C 'craft':136C 'crash':163C 'data':151C 'denial':169C 'dos':172C 'download':87C 'error':118C 'exceed':105C 'execut':159C 'exploit':131C,153C 'fail':96C 'file':89C,107C,137C 'flaw':79C 'found':81C 'ftp':92C,121C 'heap':143C 'heap-bas':142C 'integ':116C 'issu':133C 'malici':120C 'may':154C 'metadata':139C 'network':128C 'offset':102C 'on-path':125C 'overflow':146C 'path':127C 'protocol':91C 'report':109C 'result':113C,166C 'resum':85C,101C 'return':135C 'server':112C,122C 'servic':171C 'size':108C,138C 'success':152C 'transfer':90C 'trigger':140C 'util':95C 'verifi':98C 'wget':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T13:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124747","severity":null,"published_at":"2026-11-10T13:18:22+00:00","modified_at":"2026-11-10T13:18:22+00:00","first_seen_at":"2026-11-10T13:22:03+00:00","fetched_at":"2026-11-10T13:22:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124747:2456","url":"https://access.redhat.com/security/cve/CVE-2026-124747","severity":null,"published_at":"2026-11-10T13:25:04+00:00","modified_at":"2026-11-10T13:25:04+00:00","first_seen_at":"2026-11-10T13:25:04+00:00","fetched_at":"2026-11-10T13:25:04+00:00","note":"Red Hat CVE page and Bugzilla 2569520 give description, CVSS 7.5 and no mitigation, but no affected/fixed versions or upstream patch. NVD page empty, busybox.net news (latest 1.38.0, 13 May 2026) does not mention it. Exa search found nothing specific; X not searched. Fix unknown, not marked verified.","cites":["https://access.redhat.com/security/cve/CVE-2026-124747","https://bugzilla.redhat.com/show_bug.cgi?id=2569520"]}],"documents":[{"id":115209,"url":"https://access.redhat.com/security/cve/CVE-2026-124747","title":"Red Hat: CVE-2026-124747","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":115210,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569520","title":"Red Hat Bugzilla 2569520","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}