CVE-2026-124741— Busybox: stack buffer overflow in udhcpc6 send_d6_renew() and send_d6_release()

Quick assessment

Affected

Red Hat Red Hat Enterprise Linux 6

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 BusyBox 中发现了一个安全漏洞。其 DHCPv6 客户端 udhcpc6 在将服务器发送的网络选项复制到内存之前，未能正确验证这些选项的大小。本地网络中的恶意 DHCPv6 服务器可通过发送精心构造的响应来利用该漏洞，从而触发基于栈的缓冲区溢出。该漏洞可能使攻击者以 root 权限执行任意代码，或导致拒绝服务（DoS）崩溃。

CVSS 7.6 · High Updated Nov 11, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Busybox: stack buffer overflow in udhcpc6 send_d6_renew() and send_d6_release()

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, triggering a stack-based buffer overflow. This vulnerability could allow an attacker to achieve arbitrary code execution with root privileges or cause a denial of service (DoS) crash.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存写

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Red Hat	Red Hat Enterprise Linux 6	-	`cpe:/o:redhat:rhel_els:6`
Red Hat	Red Hat Hardened Images	-	`cpe:/a:redhat:hummingbird:1`

II. Public POCs for CVE-2026-124741

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124741

请登录查看更多情报信息。

Other References for CVE-2026-124741 (2)

https://access.redhat.com/security/cve/CVE-2026-124741 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2571617 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-124741

Same Patch Batch · Red Hat · 2026-11-11 · 10 CVEs total

CVE-2026-124739	7.5 HIGH	Busybox: httpd stack buffer overflow via an "i:" rule in a subdirectory httpd.conf
CVE-2026-124737	7.5 HIGH	Busybox: heap buffer overflow in the tftp client on fallback to the default block size
CVE-2026-116468	6.6 MEDIUM	Keycloak-services: keycloak-services: delegated admin escalates to realm-admin via group m
CVE-2026-124744	6.3 MEDIUM	Busybox: cpio hardlink target not sanitized under feature_path_traversal_protection
CVE-2026-124745	6.3 MEDIUM	Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extr
CVE-2026-124743	5.5 MEDIUM	Busybox: divide-by-zero and heap over-read in the volume_id hfs+ prober
CVE-2026-124742	5.5 MEDIUM	Busybox: divide-by-zero in the volume_id fat prober via a zero sectors_per_cluster value
CVE-2026-124738	5.3 MEDIUM	Busybox: httpd password rule bypass for pre-compressed .gz files via accept-encoding: gzip
CVE-2026-124740	4.3 MEDIUM	Busybox: use-after-free of requested_ipv6 in udhcpc6

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 6

Same vendor: Red Hat

Same weakness: CWE-787