{"affected":[{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"busybox","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"busybox","product":"Red Hat Hardened Images","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-124746","cwes":["CWE-190"],"description":"A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.5,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},{"score":5.5,"severity":"medium","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794410239697,"publishedAt":1794409387440,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-124746"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571675"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-124746"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571675"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"revision":"fbf40e435f3bf948777c1fddca84ce4091904cdebd49949f381ee06b2da5afc9","sources":[{"modifiedAt":1794409387440,"name":"CNA: redhat","retrievedAt":1794413387297,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124746"},{"modifiedAt":1794410239697,"name":"NVD","retrievedAt":1794421055176,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124746"}],"ssvc":null,"status":"published","title":"Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound","updatedAt":1794421055176}