A vulnerability was found in the BusyBox romfs filesystem volume identification module (util-linux/volume_id/romfs.c). When parsing a romfs superblock, the code calls strlen() on attacker-controlled volume name metadata without any bounds checking. The resulting length is passed to memcpy() via volume_id_set_label_string(), which copies the data into a fixed-size label field of approximately 65 bytes.

A crafted romfs filesystem image can contain a volume name of up to approximately 4080 bytes. When such an image is processed by blkid or findfs, the unbounded memcpy() writes far beyond the label buffer boundary, corrupting adjacent heap memory.