BusyBox versions before the commit 42202bfb1e6ac51fa995beda8be4d7b654aeee2a contain a heap buffer overflow in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler. The vulnerability arises from incorrect heap allocation calculations in option_to_env(), allowing a crafted D6_OPT_DNS_SERVERS option to overwrite adjacent memory. When exploited, an attacker can cause a denial of service or, in the worst case, achieve arbitrary code execution on the affected embedded system. The weakness is formally classified as CWE‑122 and CWE‑131, a heap-based buffer overflow and an incorrect heap size calculation.

The vulnerability impacts all instances of BusyBox packaged by vda‑linux:busybox_mirror that are built before the fix commit. No specific version numbers are listed, but any BusyBox release that does not include the change in commit 42202bfb1e6ac51fa995beda8be4d7b654aeee2a is affected. The problem resides in the DHCPv6 client (udhcpc6) component, so other BusyBox binaries are not directly affected.

The CVSS score of 7.2 indicates a medium‑to‑high severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at the time of analysis. The attack requires a network‑adjacent attacker to send a crafted DHCPv6 response with an illegal DNS_SERVERS option. This means the threat is limited to devices on the same subnet or connected through trusted network equipment. However, since the vulnerability can lead to arbitrary code execution on embedded systems, the risk is significant for networks that rely on BusyBox for DHCPv6 functionality.