BusyBox: Divide-by-zero in FAT volume identification causes denial of service
Summary
A flaw in BusyBox's volume identification component allows a divide-by-zero when a crafted FAT filesystem with a zero sectors-per-cluster value is probed. An attacker who can present a crafted storage device or disk image to a system running the affected utilities can crash the probing tools. This can disrupt device discovery and boot operations. The issue is local, requires user interaction, and affects availability only.
Affected
- Red Hat Enterprise Linux 6: status unknown according to the CVE record
- Red Hat Hardened Images: all versions marked affected
- Affected BusyBox versions: Unknown.
Fixed in
Unknown. Red Hat references upstream commit b7c89c4 in the vda-linux BusyBox mirror, but the fixed release has not been confirmed.
Workaround
- No vendor-documented workaround or mitigation is available.
Exploitation
- Not known to be exploited.
- No public proof of concept found.
- VulDB states that no exploit is available.
Our recommendation
- Check whether BusyBox is present in your images, appliances, initramfs builds or containers, and whether any of them are Red Hat Hardened Images or RHEL 6.
- Do not attach untrusted USB sticks or disk images to affected systems.
- Restrict automounting of removable media on kiosks and appliances.
- Apply the BusyBox or Red Hat update once the fixed version is confirmed.
- Monitor the Red Hat advisory and NVD for status changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-124742 access.redhat.com
- Red Hat Bugzilla 2571620 bugzilla.redhat.com
- Upstream commit b7c89c4 (BusyBox mirror) github.com
- CVE Program record CVE-2026-124742 www.cve.org
- VulDB entry 435750 vuldb.com
- threatint CVE record CVE-2026-124742 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:07.
Original description (NVD)
A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.