PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-29004 vda-linux CVE debrief

CVE-2026-29004 is a heap buffer overflow vulnerability in the BusyBox DHCPv6 client (udhcpc6) DNS_SERVERS option handler. The vulnerability exists in BusyBox versions before commit 42202bf. An attacker can exploit this vulnerability by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option, potentially leading to denial of service or arbitrary code execution on embedded systems without heap hardening. The vulnerability has a CVSS score of 7.2 and is classified as HIGH severity. BusyBox is a common software package used in many embedded systems, including routers, set-top boxes, and other network devices. The vulnerability was publicly disclosed on May 4, 2026, and has since been modified on June 30, 2026.

Vendor
vda-linux
Product
busybox_mirror
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-04
Original CVE updated
2026-07-15
Advisory published
2026-05-04
Advisory updated
2026-07-15

Who should care

Organizations using BusyBox in their embedded systems should prioritize patching this vulnerability. This includes manufacturers of network devices, such as routers and set-top boxes, as well as organizations that use these devices. Additionally, security teams responsible for monitoring and patching vulnerabilities in their organization's inventory should be aware of this vulnerability and take steps to mitigate it. Embedded system developers who use BusyBox should also review their code and patch the vulnerability as needed.

Technical summary

The vulnerability exists in the option_to_env() function in the networking/udhcp/d6_dhcpc.c file of BusyBox. The function incorrectly calculates the heap buffer allocation for the DNS_SERVERS option, allowing an attacker to overflow the buffer and potentially execute arbitrary code. The vulnerability can be exploited by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. The exploit would require network adjacency to the target device.

Defensive priority

High priority should be given to patching this vulnerability, as it can be exploited to achieve arbitrary code execution on embedded systems. Organizations should prioritize patching devices that are most vulnerable to exploitation, such as those with public-facing interfaces or those used in critical infrastructure.

Recommended defensive actions

  • Patch BusyBox to the latest version or apply the relevant patches.
  • Implement network segmentation to limit the attack surface.
  • Monitor network traffic for suspicious DHCPv6 activity.
  • Perform regular vulnerability scans and risk assessments.
  • Consider implementing additional security controls, such as heap hardening.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its CVSS score and severity. The source item URL provides additional information on the vulnerability, including references to the BusyBox project and Red Hat errata. The references provided include links to the BusyBox project, GitHub commits, and Red Hat errata.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-29004 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-29004

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-29004 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-29004

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.