BusyBox udhcpc6 Heap Overflow (CVE-2026-29004) Exposes Embedded Systems

The National Vulnerability Database has disclosed CVE-2026-29004, a critical heap buffer overflow vulnerability affecting BusyBox before commit 42202bf. Specifically, the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c is susceptible. This flaw allows network-adjacent attackers to trigger memory corruption by sending a malformed DHCPv6 response containing a crafted D6_OPT_DNS_SERVERS option.

The core issue, as detailed by the National Vulnerability Database, lies in incorrect heap buffer allocation calculations within the option_to_env() function. This enables attackers to exploit the vulnerability for denial of service or, more critically, achieve arbitrary code execution on embedded systems lacking heap hardening. With a CVSS score of 8.1 (HIGH), the impact is significant, particularly given BusyBox’s widespread use in IoT and embedded devices.

Attackers’ calculus here is clear: target the ubiquity of BusyBox in devices often left unpatched or difficult to update. A network-adjacent attack vector means local network access, but lateral movement or compromised internal devices could easily provide that. The potential for arbitrary code execution transforms a simple network misconfiguration into a full system compromise, offering a beachhead into critical infrastructure or sensitive networks.