CVE-2026-29004: CWE-122: Heap-based Buffer Overflow in vda-linux busybox_mirror
BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.
AI Analysis
Technical Summary
CVE-2026-29004 is a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) of BusyBox prior to commit 42202bf. The flaw arises from incorrect heap buffer allocation calculations in the option_to_env() function when processing the D6_OPT_DNS_SERVERS option in DHCPv6 responses. Network-adjacent attackers can exploit this by sending a crafted DHCPv6 response with a malformed DNS_SERVERS option, potentially causing memory corruption. This can result in denial of service or arbitrary code execution on embedded systems without heap hardening. Red Hat has issued a security advisory and released updated BusyBox RPMs (version 1.37.0-7.3.hum1) for their Hardened Images to mitigate this vulnerability.
Potential Impact
The vulnerability allows network-adjacent attackers to trigger heap memory corruption by sending specially crafted DHCPv6 responses. This can lead to denial of service or arbitrary code execution on affected embedded systems that do not implement heap hardening. The CVSS 4.0 score is 7.2 (high severity), reflecting the potential for high impact without requiring privileges or user interaction.
Mitigation Recommendations
Red Hat has released updated BusyBox RPMs (busybox-1.37.0-7.3.hum1 and related packages) as part of their Hardened Images to address CVE-2026-29004. Users of affected Red Hat Hardened Images should apply these updates promptly. Patch status is confirmed by the vendor advisory. No alternative mitigations are specified in the advisory.
CVE-2026-29004: CWE-122: Heap-based Buffer Overflow in vda-linux busybox_mirror
Description
BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.
CVSS v4.0
Score 7.2high
Affected software
pkg:github/vda-linux/busybox_mirrorRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-29004 is a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) of BusyBox prior to commit 42202bf. The flaw arises from incorrect heap buffer allocation calculations in the option_to_env() function when processing the D6_OPT_DNS_SERVERS option in DHCPv6 responses. Network-adjacent attackers can exploit this by sending a crafted DHCPv6 response with a malformed DNS_SERVERS option, potentially causing memory corruption. This can result in denial of service or arbitrary code execution on embedded systems without heap hardening. Red Hat has issued a security advisory and released updated BusyBox RPMs (version 1.37.0-7.3.hum1) for their Hardened Images to mitigate this vulnerability.
Potential Impact
The vulnerability allows network-adjacent attackers to trigger heap memory corruption by sending specially crafted DHCPv6 responses. This can lead to denial of service or arbitrary code execution on affected embedded systems that do not implement heap hardening. The CVSS 4.0 score is 7.2 (high severity), reflecting the potential for high impact without requiring privileges or user interaction.
Mitigation Recommendations
Red Hat has released updated BusyBox RPMs (busybox-1.37.0-7.3.hum1 and related packages) as part of their Hardened Images to address CVE-2026-29004. Users of affected Red Hat Hardened Images should apply these updates promptly. Patch status is confirmed by the vendor advisory. No alternative mitigations are specified in the advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-03-03T16:42:01.012Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-29004","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:30652","vendor":"Red Hat"}]
Threat ID: 69f8e3e0cbff5d86103e4653
Added to database: 05/04/2026, 18:22:24 UTC
Last enriched: 07/15/2026, 08:48:46 UTC
Last updated: 08/03/2026, 19:17:59 UTC
Views: 107
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.