Bug 2571609

Summary: CVE-2026-124737 busybox: Heap buffer overflow in the tftp client on fallback to the default block size [fedora-all]
Product: [Fedora] Fedora Reporter: Vladimir Vasilev <vvasilev>
Component: busyboxAssignee: Tom "spot" Callaway <spotrh>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: admiller, davide, dvlasenk, epel-packagers-sig, spotrh, suraj.ghimire7
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["bc7da6cd-5a0e-4b5b-8680-ca96e502536a"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2571607    

Description Vladimir Vasilev 2026-11-11 09:27:42 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in BusyBox's tftp client. When the server's first reply to a read or write request is not an OACK packet, the client falls back to the default block size of 512 bytes without reallocating the packet buffers, which were allocated for the smaller block size requested with the -b option. A malicious tftp server can exploit this by sending a 516-byte datagram that is stored into the undersized heap buffer; on upload, 512 bytes of the local file are read into the undersized buffer. Processing a crafted tftp transfer may cause the client to crash or potentially execute arbitrary code.