UBUNTU-CVE-2026-124739: Buffer Overflow
A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the server process.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using BusyBox's httpd web server and processing subdirectory configuration files are exposed. Exploitation requires an attacker to have permission to write to one of those subdirectory configuration files.
What does an attacker need to exploit the vulnerability?
The attacker needs write access to a subdirectory configuration file and must be able to supply an overly long index page name through that file. The issue occurs when the BusyBox httpd server processes the configuration.
What is the potential impact if exploitation succeeds?
An attacker may execute arbitrary code with elevated privileges or crash the httpd server process, causing a denial of service.
How can I tell whether my environment may be affected?
Check whether BusyBox httpd is in use and whether it processes per-subdirectory configuration files. Also identify accounts or processes that can write to those files, since that access is required for exploitation.