A flaw was identified in BusyBox's udhcpc DHCP client. The client replaces a validated packet length with an attacker‑controlled value from the IP header and fails to re‑validate the minimum size. This causes an integer underflow during header size subtraction, after which a memory copy is performed with an extraordinarily large length field. The result is a crash of udhcpc, causing the client to terminate and leading to a denial of service that disrupts network connectivity.

The vulnerable product is the udhcpc client bundled with Red Hat Hardened Images (Hummingbird). All systems running this image that use udhcpc and receive raw DHCP traffic on the local segment are potentially affected. The specific BusyBox release is unspecified; the flaw exists across builds until a patch is applied.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available, suggesting a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker with a device on the same LAN segment can send a specially crafted DHCP packet to trigger the underflow, causing udhcpc to crash. Because the flaw is triggered by local network traffic, it is a local‑segment attack vector but can impact any host that relies on udhcpc for DHCP service.