BusyBox’s romfs volume ID parser performs an unbounded string copy when reading attacker‑controlled metadata. A crafted filesystem image can overflow the fixed‑size label buffer, corrupting heap memory and potentially allowing an attacker to execute arbitrary code. The flaw is a classic heap buffer overflow, a vulnerability that can be leveraged for privilege escalation or system compromise. The impact is limited to systems that invoke the vulnerable BusyBox utilities on such images, but the consequences can be severe if the attacker gains write access to system memory.

Red Hat Hardened Images, specifically the Hummingbird 1 release, are affected. No higher‑ or lower‑version scope is listed; the vulnerability exists in the current packaged image as provided by Red Hat. If other forks or custom builds of BusyBox include the same romfs parser logic, they are likely affected as well.

The CVSS score of 7.3 indicates a high seriousness. EPSS data is unavailable, but the fact that the bug is not yet in the CISA KEV catalog suggests it has not been widely exploited publicly. Exploitation requires delivery of a malicious filesystem image to a system running the BusyBox blkid or findfs utilities; such images can be processed automatically by various tools or manually by users. The attack vector is therefore local or authenticated, potentially escalated if the system processes untrusted images as part of routine maintenance or backup operations.