Is CVE-2026-88833 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88833 being exploited in the wild.

How severe is CVE-2026-88833?

Medium severity, with a CVSS score of 6.5, published 13 October 2026.

How is CVE-2026-88833 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-88833?

Check whether you run Busybox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88833: BusyBox udhcpc integer underflow in DHCP packet processing

CVE-2026-88833 · Severity: medium · CVSS 6.5 · Published 2026-10-13

BusyBox's udhcpc is a lightweight DHCP client used on embedded devices and minimal systems to obtain network configuration. A flaw in its packet processing allows an attacker on the same network to send a malicious DHCP packet that crashes the client, causing loss of network connectivity. This denial of service affects any system relying on udhcpc for network setup.

Technologies: Busybox. Vendors: Busybox.

Quick answers

Is CVE-2026-88833 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88833 being exploited in the wild.
How severe is CVE-2026-88833?: Medium severity, with a CVSS score of 6.5, published 13 October 2026.
Which products and versions are affected?: Busybox udhcpc component.
Is there a fix for CVE-2026-88833?: No fixed version is recorded yet. If feasible, use udhcpc in LISTEN_KERNEL mode instead of LISTEN_RAW, or use an alternative DHCP client such as dhclient or systemd-networkd. Restrict DHCP traffic on the local network segment (for example using DHCP snooping on switches). If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88833 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-88833?: Check whether you run Busybox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

If feasible, use udhcpc in LISTEN_KERNEL mode instead of LISTEN_RAW, or use an alternative DHCP client such as dhclient or systemd-networkd. Restrict DHCP traffic on the local network segment (for example using DHCP snooping on switches).

Technical details

An integer underflow vulnerability in udhcpc's d4_recv_raw_packet() function occurs when the client processes raw DHCP packets: it replaces a validated packet length with an attacker-controlled value from the IP header without re-validation, leading to integer underflow when subtracting header sizes and a subsequent oversized memory copy operation. An attacker on the same Layer 2 network segment (adjacent network) can trigger reliable denial of service by sending a specially crafted packet, causing the DHCP client to crash and lose network configuration.

Affected products

BusyBox BusyBox udhcpc component

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.