BusyBox udhcpc6: Stack-based buffer overflow in DHCPv6 client
Summary
The udhcpc6 DHCPv6 client in BusyBox does not validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the same local network can send a crafted reply and trigger a stack-based buffer overflow. Successful exploitation could lead to arbitrary code execution, usually with root privileges, or to a denial of service crash.
Affected
- BusyBox udhcpc6 DHCPv6 client
- Red Hat Hardened Images (default: affected)
- Red Hat Enterprise Linux 6 (default: unaffected)
- Affected BusyBox versions: Unknown.
Fixed in
- Unknown. No fixed version is listed in the Red Hat record.
- Red Hat states that no mitigation currently meets its criteria; no patch is confirmed for CVE-2026-124741.
Workaround
- Avoid the udhcpc6 client where security is critical.
- Restrict exposure to untrusted DHCPv6 servers on the local network.
- Keep affected devices off untrusted VLANs and guest networks.
- Consider DHCPv6 guard on managed switches.
Exploitation
- Attack requires an attacker on the same local network segment.
- No authentication and no user interaction are required.
- No public proof-of-concept or exploitation in the wild is known for this CVE.
Our recommendation
- Identify devices running BusyBox with udhcpc6 enabled, such as appliances, routers, IoT or OT devices and custom embedded Linux images.
- Standard Red Hat Enterprise Linux is not affected because it uses NetworkManager.
- Isolate affected devices from untrusted networks and disable IPv6 DHCPv6 client use where feasible.
- Apply vendor updates as soon as a confirmed fix is published and monitor the Red Hat CVE page.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-124741 access.redhat.com
- Red Hat Bugzilla 2571617 bugzilla.redhat.com
- OSV OESA-2026-2357 osv.dev
- OffSeq radar entry CVE-2026-124741 radar.offseq.com
- BusyBox upstream patch mailing list post (unconfirmed mapping) www.mail-archive.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:23.
Original description (NVD)
A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, triggering a stack-based buffer overflow. This vulnerability could allow an attacker to achieve arbitrary code execution with root privileges or cause a denial of service (DoS) crash.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.