BusyBox EUVD-2026-85513

Exploitation requires a target that uses BusyBox's built-in TLS implementation to receive and parse an inbound TLS ClientHello (i.e. BusyBox acting as a TLS server or handshake receiver, or otherwise invoking get_client_hello() on attacker-supplied handshake bytes). The attacker must be able to open a connection and send a malformed, truncated ClientHello. The primary limiting factor is that BusyBox's TLS code is most commonly used as a client (e.g. wget/https), so the vulnerable server-side ClientHello-parsing path is not present in typical deployments; impact is bounded to a limited memory over-read (C:L) with no authentication or user interaction required.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 MEDIUM) describes a network-reachable, unauthenticated, low-complexity out-of-bounds read (CWE-125) whose only impact is limited confidentiality (C:L) - no integrity or availability effect is claimed by the reporter. No EPSS score, no CISA KEV listing, and no POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. The signals are internally consistent: a memory over-read that leaks small amounts of adjacent process memory matches C:L/I:N/A:N. One caveat worth verifying: out-of-bounds reads frequently also crash the process, which would argue for A:L, yet the vendor scored A:N - real-world impact could include a denial-of-service the base score does not capture. Additionally, the flaw requires BusyBox's minimal TLS code to be parsing an inbound ClientHello (i.e. acting in a TLS-server/handshake-receiver role), which is an uncommon deployment for BusyBox and materially limits real-world exposure below what AV:N/PR:N alone suggests.

An attacker connects to a service backed by BusyBox's built-in TLS implementation and sends a deliberately truncated TLS ClientHello message. When get_client_hello() parses it, the code reads past the end of the input buffer, potentially returning or acting on adjacent heap/stack memory and leaking small fragments of process memory or crashing the handler. No public exploit code was identified, and success depends on BusyBox being used to receive/parse ClientHello messages.