CVE-2026-88833

Awaiting Analysis Awaiting Analysis - Queue

Integer Underflow in BusyBox udhcpc DHCP Client

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: redhat-SADP

Description

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-88833

EUVD

EUVD-2026-98897

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Hardened Images *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This vulnerability is in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client uses an attacker-controlled value from the IP header for packet length without re-validating the minimum size. This causes an integer underflow during header size subtraction, leading to a memory copy with an extremely large length. An attacker on the same network segment can exploit this to crash the DHCP client, causing denial of service and loss of network connectivity.

Detection Guidance

Check if your system uses BusyBox's udhcpc in LISTEN_RAW mode by inspecting running processes with ps aux | grep udhcpc. If LISTEN_RAW mode is active, the system may be vulnerable. Monitor network traffic for malformed DHCP packets using tools like tcpdump or Wireshark to detect unusual packet lengths or crashes.

Impact Analysis

If your system uses BusyBox's udhcpc in LISTEN_RAW mode, an attacker on the same network segment could send a specially crafted DHCP packet to crash the DHCP client. This would result in denial of service and loss of network connectivity for your device. Systems using NetworkManager with dhclient are unlikely to be affected.

Compliance Impact

This vulnerability primarily causes denial of service by crashing the DHCP client, leading to loss of network connectivity. It does not directly impact data confidentiality or integrity, which are key focus areas for GDPR and HIPAA. However, prolonged network outages could disrupt access to critical systems, potentially affecting compliance with availability requirements in these regulations.

Mitigation Strategies

Switch udhcpc to LISTEN_KERNEL mode if supported. Alternatively, replace udhcpc with a different DHCP client like dhclient or systemd-networkd. Restrict local DHCP traffic by configuring firewalls to limit exposure to untrusted networks.

Hi! I’m here to help you understand CVE-2026-88833. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70