A flaw was found in BusyBox's udhcpc6. The server's SERVERID, IA_NA and IA_PD options are stored verbatim and later copied into a fixed-size struct d6_packet on the stack together with the client's own options, without a size check. A malicious DHCPv6 server on the link can send a Reply whose options cause the next Renew to write 34 bytes past the end of the stack object (Release overflows by 20), with content that is partially controlled by the server. This may cause the udhcpc6 process, which runs as root, to crash and could potentially lead to arbitrary code execution.