{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"busybox","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"busybox","product":"Red Hat Hardened Images","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-124737","cwes":["CWE-787"],"description":"A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing the application.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794392203743,"publishedAt":1794390057419,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-124737"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571607"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-124737"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571607"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"revision":"5297dd80e73c2c847268521b1836a1497404aae3cffcced78f15b04ebdec665c","sources":[{"modifiedAt":1794390057419,"name":"CNA: redhat","retrievedAt":1794391704479,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124737"},{"modifiedAt":1794392203743,"name":"NVD","retrievedAt":1794399482389,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124737"}],"ssvc":null,"status":"published","title":"Busybox: heap buffer overflow in the tftp client on fallback to the default block size","updatedAt":1794399482389}