CVE-2026-124743: Busybox: divide-by-zero and heap over-read in the volume_id hfs+ prober
A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly validate header values in HFS+ filesystems. An attacker able to attach a storage device or supply a specially crafted filesystem image can trigger an application crash, resulting in a Denial of Service (DoS) and preventing device resolution.
Other sources
A flaw was found in BusyBox's volumeid HFS+ prober. A blocksize value of 0 in the volume header is used as a divisor, causing a divide-by-zero (SIGFPE) crash, and the catalog leafnodesize is never validated, allowing a heap out-of-bounds read. A crafted HFS+ filesystem image on an attached device triggers these issues when probed by blkid, findfs or mount LABEL=/UUID=, causing the probing applet to crash and preventing device resolution.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems using BusyBox volume identification utilities are exposed when they probe HFS+ filesystem metadata from an attached storage device or a supplied filesystem image. The affected probing paths include blkid, findfs, and mount operations using LABEL= or UUID=.
What does an attacker need to exploit the flaw?
An attacker needs to provide a specially crafted HFS+ filesystem image or attach a storage device containing one, and have it processed by a vulnerable BusyBox probing path. No privileges are required by the vulnerability itself, but user interaction is required to attach or process the attacker-controlled media or image.
What happens when exploitation succeeds?
The probing applet can crash due to a divide-by-zero condition or a heap out-of-bounds read. This causes a denial of service by preventing device resolution.
How can I tell whether I may be affected?
You may be affected if BusyBox tools such as blkid or findfs, or mount with LABEL= or UUID=, probe HFS+ volumes. A crash of the relevant probing applet while processing an HFS+ device or image is an indicator of exposure.