{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"busybox","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"busybox","product":"Red Hat Hardened Images","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-124741","cwes":["CWE-787"],"description":"A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, triggering a stack-based buffer overflow. This vulnerability could allow an attacker to achieve arbitrary code execution with root privileges or cause a denial of service (DoS) crash.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.6,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},{"score":7.6,"severity":"high","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"}],"modifiedAt":1794395837397,"publishedAt":1794393674290,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-124741"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571617"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-124741"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571617"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"revision":"b5e2085ccb89080e264dfd82ae2ba9b8e5b73fdbe7e3242343d045a2298a51ba","sources":[{"modifiedAt":1794393674290,"name":"CNA: redhat","retrievedAt":1794395356552,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124741"},{"modifiedAt":1794395837397,"name":"NVD","retrievedAt":1794399496462,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124741"}],"ssvc":null,"status":"published","title":"Busybox: stack buffer overflow in udhcpc6 send_d6_renew() and send_d6_release()","updatedAt":1794399496462}