vda-linux busybox_mirror d6_dhcpc.c option_to_env heap-based overflow

Summaryinfo

A vulnerability was found in vda-linux busybox_mirror. It has been declared as critical. Affected by this issue is the function option_to_env of the file networking/udhcp/d6_dhcpc.c. Such manipulation leads to heap-based overflow. This vulnerability is referenced as CVE-2026-29004. The attack needs to be initiated within the local network. No exploit is available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in vda-linux busybox_mirror (version now known). Affected by this issue is the function option_to_env of the file networking/udhcp/d6_dhcpc.c. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.

The weakness was published by Kazuma Matsumoto as 42202bfb1e6ac51fa995beda8be4d7b654aeee2a. The advisory is available at github.com. This vulnerability is handled as CVE-2026-29004 since 03/03/2026. The exploitation is known to be easy. Access to the local network is required for this attack to succeed. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 05/28/2026).

The vulnerability scanner Nessus provides a plugin with the ID 316847 (SUSE SLES15 Security Update : busybox (SUSE-SU-2026:2053-1)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 42202bfb1e6ac51fa995beda8be4d7b654aeee2a is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (316847) and CERT Bund (WID-SEC-2026-1356). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Open Source BusyBox

Productinfo

Vendor

• vda-linux

Name

• busybox_mirror

License

• open-source

Website

• Product: https://github.com/vda-linux/busybox_mirror/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion