Heap Buffer Overflow in BusyBox DHCPv6 Client

Publication date: 2026-05-04

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-04

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-05-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-29004

Affected Vendors & Products

Vendor	Product	Version / Range
busybox	busybox	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Impact Analysis

Exploitation of this vulnerability can lead to denial of service or arbitrary code execution on affected embedded systems that do not have heap hardening. This means attackers could crash the system or potentially run malicious code remotely, compromising system integrity and availability.

Executive Summary

This vulnerability exists in BusyBox versions before commit 42202bf, specifically in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler. It is a heap buffer overflow caused by incorrect heap buffer allocation calculations in the option_to_env() function. Network-adjacent attackers can exploit this by sending a specially crafted DHCPv6 response containing a malformed D6_OPT_DNS_SERVERS option, which triggers memory corruption.

Hi! I’m here to help you understand CVE-2026-29004. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70