CVE-2026-29004
Awaiting Analysis Awaiting Analysis - Queue
Heap Buffer Overflow in BusyBox DHCPv6 Client

Publication date: 2026-05-04

Last updated on: 2026-05-06

Assigner: VulnCheck

Description
BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-04
Last Modified
2026-05-06
Generated
2026-06-16
AI Q&A
2026-05-05
EPSS Evaluated
2026-06-15
NVD
CVE-2026-29004
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
busybox busybox *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

Exploitation of this vulnerability can lead to denial of service or arbitrary code execution on affected embedded systems that do not have heap hardening. This means attackers could crash the system or potentially run malicious code remotely, compromising system integrity and availability.

Executive Summary

This vulnerability exists in BusyBox versions before commit 42202bf, specifically in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler. It is a heap buffer overflow caused by incorrect heap buffer allocation calculations in the option_to_env() function. Network-adjacent attackers can exploit this by sending a specially crafted DHCPv6 response containing a malformed D6_OPT_DNS_SERVERS option, which triggers memory corruption.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-29004. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart