CVE-2026-124737

BusyBox: Mehrere Schwachstellen

Red Hat Enterprise Linux, Open Source BusyBox

A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS)…

11. Nov 2026

Ausgewertete Quellen

• Red Hat
  https://access.redhat.com/security/cve/CVE-2026-124737
• Red Hat
  https://bugzilla.redhat.com/show_bug.cgi?id=2571607
• CERT-Bund
  WID-SEC-2026-4451
• NVD
  CVE-2026-124737