# CVE-2026-124743: BusyBox divide-by-zero in HFS+ filesystem parsing

Source: https://junglewise.ai/threats/cve-2026-124743-a-flaw-was-found-in-busybox-when-processing-filesystem-metadata  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-124743 · Severity: medium · CVSS 5.5 · Published 2026-11-11

BusyBox is a lightweight command-line utility suite used in embedded systems and Linux rescue environments. A flaw in its HFS+ filesystem volume identification component fails to validate header values, allowing an attacker with the ability to supply a specially crafted storage device or filesystem image to crash the application. This results in denial of service and prevents the system from detecting and resolving filesystem labels.

Technologies: [BusyBox](https://junglewise.ai/threats/technologies/x-busybox).

## Quick answers

**Is CVE-2026-124743 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124743 being exploited in the wild.

**How severe is CVE-2026-124743?** Medium severity, with a CVSS score of 5.5, published 11 November 2026.

**Which products and versions are affected?** BusyBox.

**Is there a fix for CVE-2026-124743?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-124743 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-124743?** Check whether you run BusyBox. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A divide-by-zero vulnerability exists in the volume_id HFS+ prober component of BusyBox when processing specially crafted filesystem metadata headers. The vulnerability requires local access to attach a storage device or supply a filesystem image; no privilege escalation or network access is needed. Exploitation causes an application crash (DoS) or heap over-read during filesystem probing operations, with no confidentiality or integrity impact.

## Affected products

- BusyBox

## Timeline

- 2026-11-11: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-124743](https://access.redhat.com/security/cve/CVE-2026-124743)

## Related threats

- [BusyBox integer overflow in volume_id](https://junglewise.ai/threats/cve-2026-124746-a-flaw-was-found-in-busybox-an-integer-overflow-occurs-in-the)
- [BusyBox tar hardlink resolution path traversal](https://junglewise.ai/threats/cve-2026-124745-a-flaw-was-found-in-busybox-when-extracting-an-archive-the-tar)
- [BusyBox cpio hardlink path traversal vulnerability](https://junglewise.ai/threats/cve-2026-124744-a-flaw-was-found-in-busybox-when-extracting-files-using-the-cpio)
- [BusyBox udhcpc6 use-after-free in DHCPv6 client](https://junglewise.ai/threats/cve-2026-124740-a-flaw-was-found-in-busybox-s-udhcpc6-dhcpv6-client-a-malicious)
- [BusyBox httpd authentication bypass via pre-compressed files](https://junglewise.ai/threats/cve-2026-124738-a-flaw-was-found-in-busybox-when-the-http-daemon-httpd-has-pre)