CVE Feed

    Dashboard / CVE / CVE-2026-88833

    CVE-2026-88833

    A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.

    Published:Oct 13, 2026
    Last Modified:Oct 13, 2026
    EPS:Oct 13, 2026
    EPSS Score:
    CVSS Score:6.5

    Affected Products

    Vendor
    Busybox
    Product
    Busybox
    Vendor
    Redhat
    Product
    Hummingbird

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-92205 (CVSS 6.1) — BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allow…
    CVE-2026-90954 (CVSS 7.8) — A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks af…
    CVE-2026-88829 (CVSS 7.2) — A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests ma…
    CVE-2026-88838 (CVSS 5.5) — A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /et…
    CVE-2026-88834 (CVSS 3.7) — A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user ex…
    CVE-2026-108119 (CVSS 6.3) — A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries…
    CVE-2026-88830 (CVSS 7.5) — A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer…
    CVE-2026-88837 (CVSS 6.5) — BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the au…
    CVE-2026-88835 (CVSS 6.1) — BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bo…
    CVE-2026-88839 (CVSS 6.7) — BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds w…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High