Is CVE-2026-29004 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29004 being exploited in the wild.

How severe is CVE-2026-29004?

High severity, with a CVSS score of 8.1, published 4 May 2026.

Is there a fix for CVE-2026-29004?

A patch was published on 2026-03-01: Approximate date based on advisory text mentioning March 2026 patch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-29004 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-29004?

Check whether you run Busybox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29004: BusyBox heap buffer overflow in udhcpc6 DNS_SERVERS handler

CVE-2026-29004 · Severity: high · CVSS 8.1 · Published 2026-05-04

BusyBox is a widely used software suite that provides essential command-line tools for embedded systems and Linux distributions. A vulnerability in its DHCPv6 client allows a nearby attacker on the same network to crash the system or potentially take full control of the device. This could lead to service outages or unauthorized access to sensitive data on IoT devices and industrial equipment.

Technologies: Busybox. Vendors: Busybox.

Quick answers

Is CVE-2026-29004 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29004 being exploited in the wild.
How severe is CVE-2026-29004?: High severity, with a CVSS score of 8.1, published 4 May 2026.
Which products and versions are affected?: Busybox before commit 42202bf.
Is there a fix for CVE-2026-29004?: A patch was published on 2026-03-01: Approximate date based on advisory text mentioning March 2026 patch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29004 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-29004?: Check whether you run Busybox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the udhcpc6 DHCPv6 client within networking/udhcp/d6_dhcpc.c. The vulnerability is rooted in the option_to_env() function, where incorrect heap buffer allocation calculations occur when processing the D6_OPT_DNS_SERVERS option. Specifically, the code fails to allocate sufficient space for the formatted environment variable string. A network-adjacent attacker can exploit this by sending a crafted DHCPv6 response containing a malformed DNS_SERVERS option. On systems lacking modern heap hardening, this can lead to arbitrary code execution or a denial of service. The issue was addressed in commit 42202bf.

Affected products

BusyBox BusyBox before commit 42202bf
Red Hat Red Hat Hardened Images 1

Timeline

2026-05-04: disclosed
2026-05-04: advisory
2026-03-01: patched: Approximate date based on advisory text mentioning March 2026 patch.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.