CVE-2026-88833: Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.
Other sources
A vulnerability was found in the BusyBox DHCP client (networking/udhcp/dhcpc.c), specifically in d4recvrawpacket(). The function trusts the attacker-controlled IP totlen field to calculate the payload size. When a malicious DHCP packet is sent with IP totlen set to 20, the subtraction underflows to a negative value, wraps to a massive unsigned value, and is passed to memcpy(), causing an immediate segfault.
Remote code execution is not practical because the oversized memcpy faults immediately. The attack requires Layer 2 network adjacency.
— Red Hat
Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service
— Microsoft
Affected Software
Event History
Frequently Asked Questions
Can an attacker exploit this from outside the local network?
The attacker requires Layer 2 network adjacency and must be able to send a specially crafted DHCP packet on the same network segment as the affected client.
Is remote code execution expected from this issue?
No. The malformed length causes an oversized memcpy that faults immediately, so remote code execution is not considered practical.
What is the operational impact of a successful attack?
A successful packet can crash the BusyBox udhcpc DHCP client, causing denial of service and loss of network connectivity.