---
id: "CVE-2026-124747"
page: "https://infrastack.ai/live/CVE-2026-124747"
kind: "vulnerability"
aliases: ["CVE-2026-124747"]
title: "BusyBox wget: crafted FTP file size enables heap overflow and code execution"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "busybox", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["busybox", "embedded", "ftp", "infrastructure", "linux", "wget"]
not_affected_if: ["busybox-not-used", "gnu-wget", "https-only", "no-ftp-downloads"]
published_at: "2026-11-10T13:18:22+00:00"
first_seen_at: "2026-11-10T13:22:03+00:00"
updated_at: "2026-11-10T13:25:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124747", "first_seen_at": "2026-11-10T13:22:03+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-124747", "first_seen_at": "2026-11-10T13:25:04+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-124747", "https://bugzilla.redhat.com/show_bug.cgi?id=2569520"]}]
exploit_sources: []
---

# BusyBox wget: crafted FTP file size enables heap overflow and code execution

Link for people: https://infrastack.ai/live/CVE-2026-124747 (this .md is for agents)

When resuming an FTP download, BusyBox wget does not check that the resume offset is within the file size the server reports. A malicious FTP server or an on-path attacker can send crafted size data that causes a heap buffer overflow, which may allow arbitrary code execution or a crash.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:busybox affected range not listed fixed no fixed version listed

## How to check

- Run `busybox | head -1` to see the BusyBox version, and `ls -l $(which wget)` to see whether wget is a BusyBox link.
- Look for scripts or images that run `wget -c` against ftp:// URLs.
- No affected or fixed versions are published in Red Hat's CVE page or Bugzilla; check the BusyBox git log and your distro's tracker for a fix.

## Timeline

- 2026-11-10T13:22:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124747
- 2026-11-10T13:25:04+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-124747 — Red Hat CVE page and Bugzilla 2569520 give description, CVSS 7.5 and no mitigation, but no affected/fixed versions or upstream patch. NVD page empty, busybox.net news (latest 1.38.0, 13 May 2026) does not mention it. Exa search found nothing specific; X not searched. Fix unknown, not marked verified.

## Documents

- [advisory] Red Hat: CVE-2026-124747 https://access.redhat.com/security/cve/CVE-2026-124747
- [describes] Red Hat Bugzilla 2569520 https://bugzilla.redhat.com/show_bug.cgi?id=2569520

## From the sources

A flaw was found in BusyBox. When resuming a download over File Transfer Protocol (FTP), the wget utility fails to verify that the resume offset does not exceed the file size reported by the server, resulting in an integer calculation error. A malicious FTP server or an on-path network attacker can exploit this issue by returning crafted file size metadata, triggering a heap-based buffer overflow with attacker-controlled data. Successful exploitation may allow an attacker to execute arbitrary code or crash the application, resulting in a denial of service (DoS).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_