CVE-2026-124737: Busybox: heap buffer overflow in the tftp client on fallback to the default block size
A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing the application.
Other sources
A flaw was found in BusyBox's tftp client. When the server's first reply to a read or write request is not an OACK packet, the client falls back to the default block size of 512 bytes without reallocating the packet buffers, which were allocated for the smaller block size requested with the -b option. A malicious tftp server can exploit this by sending a 516-byte datagram that is stored into the undersized heap buffer; on upload, 512 bytes of the local file are read into the undersized buffer. Processing a crafted tftp transfer may cause the client to crash or potentially execute arbitrary code.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which BusyBox users are exposed to this issue?
Systems are exposed when they use the BusyBox TFTP client with the -b option to request a custom block size smaller than the default 512 bytes, and connect to a malicious or compromised TFTP server.
What must an attacker do to trigger the overflow?
The attacker must control or impersonate the TFTP server and respond to the client's read or write request with a first reply that is not an OACK packet. The client then falls back to 512-byte blocks while retaining buffers sized for the smaller requested block size.
Are default TFTP client settings affected?
The described condition depends on use of the -b option with a small custom block size. The data does not indicate that transfers using the default block size are affected.
What is the impact for downloads versus uploads?
During downloads, a malicious server can send a 516-byte datagram that is written into the undersized heap buffer. During uploads, the client can read 512 bytes from the local file into that undersized buffer; either path may crash the client or potentially permit arbitrary code execution.