UBUNTU-CVE-2026-124743: Medium severity ubuntu/busybox vulnerability
Published Nov 12, 2026
·Updated
A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly validate header values in HFS+ filesystems. An attacker able to attach a storage device or supply a specially crafted filesystem image can trigger an application crash, resulting in a Denial of Service (DoS) and preventing device resolution.
Affected Software
8 affected components
ubuntu/busybox*
ubuntu/busybox*
ubuntu/busybox*
ubuntu/busybox*
ubuntu/busybox*
ubuntu/busybox*
ubuntu/busybox*
ubuntu/busybox*
Event History
Nov 12, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Who is realistically exposed to this issue?
Systems using Ubuntu's BusyBox are exposed when they process metadata from an attached storage device or a supplied filesystem image containing a crafted HFS+ filesystem.
2
What does an attacker need to exploit it?
The attacker needs a way to attach a storage device or provide a specially crafted filesystem image for processing. Successful exploitation causes an application crash and can prevent device resolution.