PT-2026-36890 · Busybox · Busybox

Vulncheck · Published 2026-05-04 · Updated 2026-05-15 · CVE-2026-29004

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions BusyBox versions prior to commit 42202bf

Description A heap buffer overflow exists in the DHCPv6 client (udhcpc6) DNS SERVERS option handler within the networking/udhcp/d6 dhcpc.c file. Network-adjacent attackers can trigger memory corruption by sending a crafted DHCPv6 response containing a malformed D6 OPT DNS SERVERS option. This is possible due to incorrect heap buffer allocation calculations in the option to env() function, which may lead to denial of service or arbitrary code execution on embedded systems that lack heap hardening.

Recommendations Update to the version containing commit 42202bf.

Exploit

Fix

DoS

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2026-29004

OESA-2026-2357

OPENSUSE-SU-2026:10740-1

Affected Products

Busybox

References · 20

• 🔥 https://y637f9qq2x.com/posts/busybox-dhcpv6-heap-overflow · Exploit
• https://github.com/vda-linux/busybox_mirror/commit/d368f3f7836d1c2484c8f839316e5c93e76d4409 · Patch
• https://github.com/vda-linux/busybox_mirror/commit/42202bfb1e6ac51fa995beda8be4d7b654aeee2a · Patch
• https://cve.org/CVERecord?id=CVE-2026-29004 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-29004 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-29004 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-29004 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-29004 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-29004 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2357 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-29004 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10740-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-29004 · Note
• https://twitter.com/CVEnew/status/2051383983275909376 · Twitter Post
• https://docs.bell-sw.com/security/cves/CVE-2026-29004 · Note