CVE-2026-124746: Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound
A flaw was found in BusyBox. An integer overflow occurs in the volumeid component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.
Other sources
A flaw was found in BusyBox's volumeid. In volumeidgetbuffer(), a 64-bit offset+length addition can wrap past 2^64, passing the buffer size check and returning a pointer far outside the buffer, which the NTFS prober dereferences, causing a SIGSEGV crash. A crafted filesystem image on an attached device triggers this when probed by blkid, findfs or mount LABEL=/UUID=, preventing those applets from resolving any device.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems using BusyBox utilities that probe filesystem metadata, including blkid, findfs, or mount, may be exposed when they process an attached storage device containing a specially crafted filesystem image.
What must an attacker be able to do to trigger the denial of service?
The attacker needs to provide a specially crafted filesystem image on an attached storage device and have it probed by an affected utility. The provided vector indicates local access and user interaction are required.
What is the expected impact of successful exploitation?
The affected application crashes while probing filesystem metadata. This can prevent the system from resolving or mounting storage devices, causing a denial of service.