Is CVE-2026-124740 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124740 being exploited in the wild.

How severe is CVE-2026-124740?

Medium severity, with a CVSS score of 4.3, published 11 November 2026.

Is there a fix for CVE-2026-124740?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-124740 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-124740?

Check whether you run BusyBox. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124740: BusyBox udhcpc6 use-after-free in DHCPv6 client

CVE-2026-124740 · Severity: medium · CVSS 4.3 · Published 2026-11-11

BusyBox's DHCPv6 network configuration client contains a use-after-free vulnerability that can be triggered by a malicious server on the same local network. An attacker can crash the DHCP client (causing a denial of service) or leak sensitive network configuration data that was previously assigned to the device. This risk is primarily relevant to embedded systems, containers, and custom Linux environments that use BusyBox as their DHCP client.

Technologies: BusyBox.

Quick answers

Is CVE-2026-124740 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124740 being exploited in the wild.
How severe is CVE-2026-124740?: Medium severity, with a CVSS score of 4.3, published 11 November 2026.
Which products and versions are affected?: BusyBox.
Is there a fix for CVE-2026-124740?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-124740 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-124740?: Check whether you run BusyBox. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability (CWE-416) exists in BusyBox's udhcpc6 DHCPv6 client when processing crafted DHCPv6 reply packets that lack valid address options. An adjacent attacker on the local network link can trigger the vulnerability by operating a rogue DHCPv6 server, causing the client to read stale heap memory. The impact includes application crashes (DoS) or disclosure of previously assigned network addresses in subsequent discovery requests.

Affected products

BusyBox

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.