A unit confusion in BusyBox’s TLS Montgomery reduction buffer allocation causes a pre‑authentication heap buffer overflow when a specially crafted ClientKeyExchange message is processed. This overflow occurs before authentication, allowing an attacker to overwrite adjacent heap memory and potentially execute arbitrary code or crash the system. The flaw is categorized as CWE‑131, an improper length value allocation issue.

Red Hat Hardened Images are affected, specifically the BusyBox component in Hummingbird version 1. Any deployment that uses the BusyBox ssl_server applet in production is at risk; no other vendor or product versions are listed.

The CVSS score of 7.5 indicates a high‑severity vulnerability. The EPSS score is not available, so the current exploitation probability is unknown, but the nature of a pre‑auth heap overflow in a widely used open‑source component implies a serious potential. The vulnerability is not listed in the CISA KEV catalog, yet it could allow remote code execution via a crafted TLS handshake if the ssl_server applet is used. An attacker would need network access to the target but does not require local privileges.