# CVE-2026-124741: BusyBox udhcpc6 stack buffer overflow in DHCPv6 options

Source: https://junglewise.ai/threats/cve-2026-124741-a-flaw-was-found-in-busybox-the-udhcpc6-dhcpv6-client-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-124741 · Severity: high · CVSS 7.6 · Published 2026-11-11

BusyBox is a lightweight utility suite used in embedded systems and specialized Linux environments. The udhcpc6 DHCPv6 client component fails to validate the size of network options sent by servers, allowing a malicious DHCPv6 server on the local network to crash the client or execute arbitrary code with root privileges. This affects systems that explicitly use BusyBox for IPv6 network configuration.

Technologies: [BusyBox](https://junglewise.ai/threats/technologies/x-busybox).

## Quick answers

**Is CVE-2026-124741 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124741 being exploited in the wild.

**How severe is CVE-2026-124741?** High severity, with a CVSS score of 7.6, published 11 November 2026.

**Which products and versions are affected?** BusyBox <UNKNOWN>.

**Is there a fix for CVE-2026-124741?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-124741 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-124741?** Check whether you run BusyBox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The udhcpc6 DHCPv6 client contains a stack-based buffer overflow in functions like send_d6_renew() and send_d6_release() due to improper validation of network option sizes before memory copying (CWE-787). An attacker with network access on the same link can send a crafted DHCPv6 reply to trigger the overflow, achieving arbitrary code execution or denial of service. The process typically runs with root privileges, elevating the impact.

## Affected products

- BusyBox <UNKNOWN>

## Timeline

- 2026-11-11: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-124741](https://access.redhat.com/security/cve/CVE-2026-124741)

## Related threats

- [BusyBox integer overflow in volume_id](https://junglewise.ai/threats/cve-2026-124746-a-flaw-was-found-in-busybox-an-integer-overflow-occurs-in-the)
- [BusyBox tar hardlink resolution path traversal](https://junglewise.ai/threats/cve-2026-124745-a-flaw-was-found-in-busybox-when-extracting-an-archive-the-tar)
- [BusyBox cpio hardlink path traversal vulnerability](https://junglewise.ai/threats/cve-2026-124744-a-flaw-was-found-in-busybox-when-extracting-files-using-the-cpio)
- [BusyBox divide-by-zero in HFS+ filesystem parsing](https://junglewise.ai/threats/cve-2026-124743-a-flaw-was-found-in-busybox-when-processing-filesystem-metadata)
- [BusyBox udhcpc6 use-after-free in DHCPv6 client](https://junglewise.ai/threats/cve-2026-124740-a-flaw-was-found-in-busybox-s-udhcpc6-dhcpv6-client-a-malicious)