Vulnerability · Published May 4, 2026 · Assigned by VulnCheck

CVE-2026-29004BusyBox DHCPv6 Client Heap Buffer Overflow via DNS_SERVERS

High 8.1

In plain English

A high-severity heap buffer overflow in busybox_mirror from vda-linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 68.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	busybox	no fix listed	DEBIAN-CVE-2026-29004
Debian:13	busybox	no fix listed	DEBIAN-CVE-2026-29004
Debian:14	busybox	no fix listed	DEBIAN-CVE-2026-29004
Ubuntu:22.04:LTS	busybox	no fix listed	UBUNTU-CVE-2026-29004
Ubuntu:24.04:LTS	busybox	no fix listed	UBUNTU-CVE-2026-29004
Ubuntu:25.10	busybox	no fix listed	UBUNTU-CVE-2026-29004
Ubuntu:26.04:LTS	busybox	no fix listed	UBUNTU-CVE-2026-29004
Ubuntu:26.10	busybox	no fix listed	UBUNTU-CVE-2026-29004

Affected products (as reported)

Vendor	Product	Versions
vda-linux	busybox_mirror	0 – before 42202bfb1e6ac51fa995beda8be4d7b654aeee2a

Weakness: CWE-122, CWE-131 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

https://y637f9qq2x.com/posts/busybox-dhcpv6-heap-overflow/ technical-description, exploit
https://github.com/vda-linux/busybox_mirror/commit/42202bfb1e6ac51fa995beda8be4d7b654aeee2a patch
https://github.com/vda-linux/busybox_mirror/commit/d368f3f7836d1c2484c8f839316e5c93e76d4409 patch
https://busybox.net/ product
https://www.vulncheck.com/advisories/busybox-dhcpv6-client-heap-buffer-overflow-via-dns-servers third-party-advisory
https://access.redhat.com/security/cve/CVE-2026-29004 vdb-entry, x_refsource_REDHAT
RHBZ#2466526 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29004.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:30652 vendor-advisory, x_refsource_REDHAT