CVE-2026-29004

HighCVSS 8.1/10Last modified Oct 26, 2026

Description

BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-122 CWE-131

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
vda-linux	busybox_mirror	< 42202bfb1e6ac51fa995beda8be4d7b654aeee2a
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Enterprise Linux 6	—

References

Timeline

Published: May 4, 2026
Last modified: Oct 26, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-290075.3U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enable CVE-2026-290087.5U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a netw CVE-2026-290099.8U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled CVE-2026-290139.8libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cb CVE-2026-290149.8MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute a CVE-2026-29026.1The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frontend_rewrite' CVE-2026-290227.8dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_t CVE-2026-290237.3Keygraph Shannon contains a hard-coded API key in its router configuration that, when the router component is enabled and exposed, allows ne CVE-2026-29033.3A flaw has been found in skvadrik re2c up to 4.4. Impacted is the function check_and_merge_special_rules of the file src/parse/ast.cc. This CVE-2026-290356.5CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthentica CVE-2026-290367.5cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function CVE-2026-290386.1changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting