CVE-2026-29004 is a heap buffer overflow vulnerability in the BusyBox DHCPv6 client, specifically in the option_to_env() function handling the D6_OPT_DNS_SERVERS option. An attacker on the adjacent network can exploit this by sending a crafted DHCPv6 response with a malformed DNS servers option, leading to memory corruption. This may allow arbitrary code execution or denial of service on affected embedded systems without heap hardening. Red Hat's advisory (RHSA-2026:30652) includes updated BusyBox RPMs (version 1.37.0-7.3.hum1) for Red Hat Hardened Images to fix this vulnerability. The advisory recommends restricting DHCPv6 client network access to trusted servers or disabling the DHCPv6 client if not required. The CVSS v3.1 base score is 8.8 (high severity) as per Red Hat's assessment. No known exploits in the wild have been reported at this time.

The vulnerability can lead to memory corruption in the BusyBox DHCPv6 client, potentially resulting in arbitrary code execution or denial of service on embedded systems that lack heap hardening protections. This affects confidentiality, integrity, and availability of affected systems. Network-adjacent attackers can exploit this by sending malicious DHCPv6 responses. No active exploitation has been reported.

Red Hat has released updated BusyBox RPMs (version 1.37.0-7.3.hum1) as part of the Red Hat Hardened Images security update to address this vulnerability. Users should apply these updates to remediate the issue. Until patched, restrict network access to systems running BusyBox DHCPv6 client to only trusted DHCPv6 servers. If DHCPv6 client functionality is not essential, disable the 'udhcpc6' service or configure it to accept responses only from trusted sources. Consult product-specific documentation for network service management. Changes may require service restarts and could impact network connectivity.