A flaw was found in BusyBox's udhcpc DHCP client. (CVE-2026-88833)
Description
A vulnerability in BusyBox's udhcpc DHCP client allows an attacker on the same network segment to cause a denial of service by sending a specially crafted DHCP packet. The flaw arises from improper handling of packet length validation, leading to an integer underflow and a subsequent memory copy with an oversized length, crashing the client and disrupting network connectivity.
CVSS v3.1
Score 6.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-88833 describes a vulnerability in the BusyBox udhcpc DHCP client where the client replaces the validated DHCP packet length with a value taken from the IP header without re-validating its minimum size. This improper validation leads to an integer underflow during header size subtraction, which results in a memory copy operation using a massively oversized length. An attacker on the same local network segment can exploit this flaw by sending a crafted DHCP packet, causing the DHCP client to crash and resulting in denial of service and loss of network connectivity.
Potential Impact
The vulnerability allows an unauthenticated attacker on the same network segment to crash the DHCP client, causing denial of service and loss of network connectivity for the affected device. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, network administrators should consider network-level protections to limit exposure to untrusted DHCP servers or clients on the local network segment.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-hg7w-cw6w-99w3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-88833"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acea9282cdf04f656b679b3
Added to database: 10/13/2026, 21:56:56 UTC
Last enriched: 10/13/2026, 22:03:08 UTC
Last updated: 10/14/2026, 03:48:08 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.