{"id":"CVE-2026-124737","aliases":["EUVD-2026-123345","GHSA-r558-xpjx-65pf","UBUNTU-CVE-2026-124737"],"status":"published","title":"Busybox: heap buffer overflow in the tftp client on fallback to the default block size","description":"A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing the application.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-13","score":0.00454,"percentile":0.39927,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2026-11-11T09:40:57Z","modified":"2026-11-12T23:46:21Z","affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.20.0-8.1ubuntu1","1:1.20.0-9ubuntu1","1:1.20.0-9ubuntu2","1:1.21.0-1ubuntu1","1:1.21.0-1ubuntu1.4","1:1.21.0-1ubuntu1.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.22.0-15ubuntu1","1:1.22.0-15ubuntu1.4","1:1.22.0-15ubuntu1.4+esm1","1:1.22.0-15ubuntu1.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.22.0-19ubuntu2","1:1.27.2-1ubuntu3","1:1.27.2-1ubuntu4","1:1.27.2-2ubuntu2","1:1.27.2-2ubuntu3","1:1.27.2-2ubuntu3.1","1:1.27.2-2ubuntu3.2","1:1.27.2-2ubuntu3.3","1:1.27.2-2ubuntu3.4","1:1.27.2-2ubuntu3.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.30.1-4ubuntu4","1:1.30.1-4ubuntu5","1:1.30.1-4ubuntu6","1:1.30.1-4ubuntu6.1","1:1.30.1-4ubuntu6.2","1:1.30.1-4ubuntu6.3","1:1.30.1-4ubuntu6.4","1:1.30.1-4ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.30.1-6ubuntu3","1:1.30.1-7ubuntu1","1:1.30.1-7ubuntu2","1:1.30.1-7ubuntu3","1:1.30.1-7ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.36.1-3ubuntu1","1:1.36.1-6ubuntu1","1:1.36.1-6ubuntu3","1:1.36.1-6ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.37.0-7ubuntu1","1:1.37.0-10.1ubuntu2","1:1.37.0-10.1ubuntu3","1:1.38.0-3ubuntu1","1:1.38.0-3ubuntu3","1:1.38.0-3ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.37.0-4ubuntu1","1:1.37.0-7ubuntu1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-124737","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571607","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124737"},{"url":"https://github.com/advisories/GHSA-r558-xpjx-65pf"},{"url":"https://ubuntu.com/security/CVE-2026-124737","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-124737","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-124737","title":"Busybox: heap buffer overflow in the tftp client on fallback to the default block size","description":"A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing the application.","status":"published","published":"2026-11-11T09:40:57.419Z","modified":"2026-11-11T20:27:24.333Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-11T10:56:25.049809Z"}],"euvd":[{"id":"EUVD-2026-123345","description":"A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing the application.","status":"published","published":"2026-11-11T09:40:57Z","modified":"2026-11-11T20:27:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T14:29:05.081199Z"}],"ghsa":[{"id":"GHSA-r558-xpjx-65pf","title":"A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a...","description":"A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing the application.","status":"published","published":"2026-11-11T12:31:40Z","modified":"2026-11-11T12:31:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-11T12:34:05.637143Z"}],"nvd":[{"id":"CVE-2026-124737","description":"A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing the application.","status":"published","published":"2026-11-11T10:16:43.62Z","modified":"2026-11-11T10:16:43.743Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-11T12:24:45.117793Z"}],"osv":[{"id":"UBUNTU-CVE-2026-124737","description":"A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing the application.","status":"published","published":"2026-11-12T00:00:00Z","modified":"2026-11-13T21:05:19.565628871Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-13T21:30:20.292037Z"}]}}