CVE Feed

    Dashboard / CVE / CVE-2026-124746

    CVE-2026-124746

    A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.

    Published:Nov 11, 2026
    Last Modified:Nov 12, 2026
    EPS:Nov 11, 2026
    EPSS Score:0.00165
    CVSS Score:5.5

    Affected Products

    Vendor
    Busybox
    Product
    Busybox
    Vendor
    Red Hat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Hardened Images
    Vendor
    Redhat
    Product
    Hummingbird
    Vendor
    Redhat
    Product
    Rhel Els

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-190 Integer Overflow or Wraparound

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2026-124745 (CVSS 6.3) — A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink…
    CVE-2026-92205 (CVSS 6.1) — BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allow…
    CVE-2026-88829 (CVSS 7.2) — A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests ma…
    CVE-2026-90954 (CVSS 7.8) — A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks af…
    CVE-2026-88838 (CVSS 5.5) — A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /et…
    CVE-2026-88834 (CVSS 3.7) — A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user ex…
    CVE-2026-88833 (CVSS 6.5) — A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the va…
    CVE-2026-108119 (CVSS 6.3) — A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries…
    CVE-2026-88830 (CVSS 7.5) — A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer…
    CVE-2026-88832 (CVSS 7.3) — BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer o…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High