This vulnerability exists in the BusyBox DHCPv6 client (udhcpc6) within the networking/udhcp/d6_dhcpc.c source file. Specifically, the option_to_env() function incorrectly calculates heap buffer allocations when processing the D6_OPT_DNS_SERVERS option. An attacker on the same network can send a malicious DHCPv6 response with a malformed DNS_SERVERS option, triggering a heap buffer overflow. This may result in memory corruption, denial of service, or arbitrary code execution on embedded systems that do not implement heap hardening techniques. The issue affects BusyBox versions prior to commit 42202bf.

Successful exploitation can cause denial of service or arbitrary code execution on vulnerable embedded systems. The attack requires network adjacency and no privileges or user interaction. The CVSS 4.0 base score is 7.2 (high), reflecting the ease of exploitation and potential impact on confidentiality and integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor for updates from the BusyBox project or vda-linux vendor. Until a patch is available, consider limiting network exposure of affected devices and applying network-level protections to block malicious DHCPv6 responses.