BusyBox versions prior to commit 42202bf contain a heap-based buffer overflow vulnerability (CWE-122) in the DHCPv6 client (udhcpc6) component, specifically in the DNS_SERVERS option handler implemented in networking/udhcp/d6_dhcpc.c. The flaw results from incorrect heap buffer allocation calculations in the option_to_env() function when processing the D6_OPT_DNS_SERVERS option in DHCPv6 responses. An attacker with network adjacency can send a specially crafted DHCPv6 response to trigger memory corruption. This can lead to denial of service or arbitrary code execution on embedded systems that do not implement heap hardening. The vulnerability is tracked as CVE-2026-29004 with a CVSS 4.0 score of 7.2 (high severity). There is no vendor advisory or patch currently available, and no known exploits have been reported.

Successful exploitation can cause memory corruption via a heap buffer overflow, leading to denial of service or potentially arbitrary code execution on vulnerable embedded systems running affected BusyBox versions. The attack requires network adjacency and no privileges or user interaction. Systems without heap hardening are particularly at risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider network-level protections to block or filter malicious DHCPv6 responses. Monitor vendor communications for updates regarding patches or mitigations.