Use-After-Free Vulnerability in BusyBox's DHCPv6 Client
CVE-2026-124740

4.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 6
Red Hat Hardened Images
Vendor
CVE Published:
11 November 2026

What is CVE-2026-124740?

A vulnerability has been discovered in BusyBox's udhcpc6 DHCPv6 client, which can be exploited by a malicious server on the local network. An attacker can exploit a crafted DHCPv6 reply lacking usable address options to trigger a use-after-free condition. This flaw causes the client to access stale heap memory, potentially leading to Denial of Service due to application crashes or exposing previously assigned network address data during subsequent discovery requests.

References

https://access.redhat.com/security/cve/CVE-2026-124740
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2571616
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank ducanhluu for reporting this issue.
.