CVE-2026-29004
High · 8.1CVSS
8.1
EPSS
0.6%
Published
May 4, 2026
CISA due date
—
The record
BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | busybox | 0 | 1.37.0-11.1 |
Related vulnerabilities
- CVE-2026-26158 A flaw was found in BusyBox. Also affects busybox
- CVE-2026-26157 A flaw was found in BusyBox. Also affects busybox
- CVE-2025-60876 BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in… Also affects busybox
- CVE-2011-5325 Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5… Also affects busybox
- CVE-2016-2148 Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows… Also affects busybox
- CVE-2026-112403 Pillow is a Python imaging library. CWE-122
- CVE-2026-112393 Pillow is a Python imaging library. CWE-122
- CVE-2026-112395 Pillow is a Python imaging library. CWE-122