REDHAT-BUG-2571624: Medium severity vulnerability

Published Nov 11, 2026

Updated

A flaw was found in BusyBox's volumeid HFS+ prober. A blocksize value of 0 in the volume header is used as a divisor, causing a divide-by-zero (SIGFPE) crash, and the catalog leafnodesize is never validated, allowing a heap out-of-bounds read. A crafted HFS+ filesystem image on an attached device triggers these issues when probed by blkid, findfs or mount LABEL=/UUID=, causing the probing applet to crash and preventing device resolution.

Affected Software

0 affected components

Event History

Nov 11, 2026

Data Sourced

via Red Hat·09:54 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are realistically exposed to this issue?

Systems using BusyBox utilities that probe attached HFS+ filesystem images are exposed. The affected probing paths include blkid, findfs, and mount operations that resolve devices through LABEL= or UUID=.

What must an attacker provide to trigger the flaw?

An attacker needs to provide or make available a crafted HFS+ filesystem image on an attached device. The issue is triggered when a BusyBox probing applet examines that image.

Is this exploitable through ordinary device resolution behavior?

Yes. Device resolution using mount LABEL= or UUID= can invoke the affected probing behavior, in addition to direct use of blkid or findfs.

What is the practical impact of successful exploitation?

The affected BusyBox probing applet can crash with a divide-by-zero SIGFPE or encounter a heap out-of-bounds read. This prevents device resolution for the crafted filesystem image.

REDHAT-BUG-2571624: Medium severity vulnerability

Affected Software

Event History

Frequently Asked Questions

Which systems are realistically exposed to this issue?

What must an attacker provide to trigger the flaw?

Is this exploitable through ordinary device resolution behavior?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are realistically exposed to this issue?

What must an attacker provide to trigger the flaw?

Is this exploitable through ordinary device resolution behavior?

What is the practical impact of successful exploitation?