{"affected":[{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"busybox","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"busybox","product":"Red Hat Hardened Images","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-124742","cwes":["CWE-369"],"description":"A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.5,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},{"score":5.5,"severity":"medium","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794425927003,"publishedAt":1794395994026,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-124742"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571620"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/vda-linux/busybox_mirror/commit/b7c89c4"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-124742"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571620"},{"source":"secalert@redhat.com","tags":[],"url":"https://github.com/vda-linux/busybox_mirror/commit/b7c89c4"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"revision":"dfdb08556fd82ca8e006f1b8e668265bb7698a9c65ad9f2a428be7d7345480f1","sources":[{"modifiedAt":1794425927003,"name":"CNA: redhat","retrievedAt":1794427739886,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124742"},{"modifiedAt":1794399587993,"name":"NVD","retrievedAt":1794421025401,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124742"}],"ssvc":null,"status":"published","title":"Busybox: divide-by-zero in the volume_id fat prober via a zero sectors_per_cluster value","updatedAt":1794427739886}