BusyBox tftp client: Heap buffer overflow on blocksize fallback
Summary
A flaw in the TFTP client of BusyBox allows a heap buffer overflow when the client requests a custom small block size and the server answers with a standard-sized response. The client falls back to the default block size without resizing its receive buffer. A malicious TFTP server can trigger the overflow during a transfer, which may allow arbitrary code execution or crash the client process. Exploitation requires that the client connects to an attacker-controlled server and uses a non-default block size.
Affected
- BusyBox tftp client (affected versions: Unknown.)
- Red Hat Enterprise Linux 6 (listed as affected by Red Hat)
- Red Hat Hardened Images (listed as affected by Red Hat)
Fixed in
Unknown. No released fix or distribution erratum was confirmed.
Workaround
- Do not run the BusyBox tftp client with a block size below 512 (option -b), in scripts or boot tooling.
- Use the TFTP client only with trusted, known servers.
- Keep TFTP off untrusted networks.
Exploitation
- Not known to be exploited.
- No public proof of concept found.
- No CISA KEV entry found; KEV status not verified.
Our recommendation
- Check whether BusyBox tftp is present in your systems, embedded devices, containers or boot setups, and whether it is used with a non-default block size.
- Restrict TFTP usage to trusted servers and local networks.
- Apply the vendor fix from Red Hat or your BusyBox distribution as soon as it is available.
- Replace or retire RHEL 6 systems that are still running, as the release is end-of-life.
- Monitor the Red Hat advisory and Bugzilla entry for fixed package versions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE-2026-124737 access.redhat.com
- Red Hat Bugzilla 2571607 bugzilla.redhat.com
- BusyBox tftp.c (1_6_stable) git.busybox.net
- BusyBox mailing list: candidate fix www.mail-archive.com
- curl CVE-2019-5482 advisory (analogous case) curl.se
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:21.
Original description (NVD)
A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing the application.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.