CVE-2026-88833

6.5Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Adjacent network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-191

Impact

Attackers on the local network segment can crash the udhcpc client, cutting off host network connectivity. They need adjacent network access to inject crafted DHCP packets; no authentication is required.

Root cause

The udhcpc client overwrites the verified packet length with an unvalidated IP header value, triggering an integer underflow during header size subtraction that results in an out-of-bounds memory copy.

Affected systems

BusyBox udhcpc; versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade BusyBox to the patched vendor package once released. If patching must wait, assign static IP configurations and stop running udhcpc on untrusted local networks.

shell

$ busybox | head -n 1

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-88833