CVE-2026-29004 Details

A heap buffer overflow vulnerability has been identified in the BusyBox DHCPv6 client (udhcpc6) prior to commit 42202bf. The vulnerability resides in the DNS_SERVERS option handler within the file networking/udhcp/d6_dhcpc.c. This flaw allows network-adjacent attackers to cause memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Exploitation takes advantage of incorrect heap buffer allocation calculations in the option_to_env() function, potentially leading to denial-of-service conditions or arbitrary code execution on embedded systems that lack heap hardening.

Users can update to BusyBox versions after the patch commit (42202bf) to address this vulnerability.