BusyBox udhcpc6 DHCPv6 client buffer overflow (CVE-2026-124741)
CVE-2026-124741 Published on November 11, 2026
Busybox: stack buffer overflow in udhcpc6 send_d6_renew() and send_d6_release()
A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, triggering a stack-based buffer overflow. This vulnerability could allow an attacker to achieve arbitrary code execution with root privileges or cause a denial of service (DoS) crash.
Vulnerability Analysis
Timeline
Reported to Red Hat.
Made public. 17 days later.
Weakness Type
What is a Memory Corruption Vulnerability?
The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.
CVE-2026-124741 has been classified to as a Memory Corruption vulnerability or weakness.
Products Associated with CVE-2026-124741
stack.watch emails you whenever new vulnerabilities are published in Red Hat Rhel Els or Red Hat Hummingbird. Just hit a watch button to start following.
