CVE-2026-124741: Busybox: stack buffer overflow in udhcpc6 send_d6_renew() and send_d6_release()
A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, triggering a stack-based buffer overflow. This vulnerability could allow an attacker to achieve arbitrary code execution with root privileges or cause a denial of service (DoS) crash.
Other sources
A flaw was found in BusyBox's udhcpc6. The server's SERVERID, IANA and IAPD options are stored verbatim and later copied into a fixed-size struct d6packet on the stack together with the client's own options, without a size check. A malicious DHCPv6 server on the link can send a Reply whose options cause the next Renew to write 34 bytes past the end of the stack object (Release overflows by 20), with content that is partially controlled by the server. This may cause the udhcpc6 process, which runs as root, to crash and could potentially lead to arbitrary code execution.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running BusyBox's udhcpc6 DHCPv6 client are exposed when they obtain DHCPv6 service from an untrusted or malicious server on the local network link. The vulnerable process runs as root.
What does an attacker need to exploit it?
An attacker needs to operate or impersonate a DHCPv6 server on the local network and send a crafted DHCPv6 Reply. No prior privileges or user interaction are required.
Is the overflow triggered during initial DHCPv6 configuration?
The malformed server options are stored from a Reply and are later copied when udhcpc6 sends a Renew or Release message. A crafted Reply can cause a Renew to write 34 bytes past the stack object, while Release can overflow by 20 bytes.
What is the likely impact?
The issue can crash the root-running udhcpc6 process, causing denial of service. Because the overflow content is partially controlled by the malicious server, arbitrary code execution with root privileges may also be possible.