EUVD-2026-98897
GHSA-hg7w-cw6w-99w3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network position
-
DeliverySend crafted raw DHCP packet
-
ExploitBypass packet-length re-validation
-
ExecutionTrigger integer underflow on header subtraction
-
PersistForce oversized memory copy and crash
-
ImpactDenial of service and network loss
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | Exploitation requires the attacker to be on the same Layer-2/local network segment as the victim (AV:A - not routable across the internet) and the target device must be running the BusyBox udhcpc DHCP client and actively processing raw DHCP packets (the default behavior when the client is soliciting or renewing a lease). No authentication (PR:N) and no user interaction (UI:N) are needed. Limiting factors: the adjacency requirement sharply narrows the attacker population to those with LAN/Wi-Fi/VLAN presence, and the impact is strictly a crash/denial of service (A:H only) - there is no path to code execution, data disclosure, or integrity loss from this flaw alone. |
| Impact | This is a moderate, availability-only vulnerability whose signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates an adjacent-network, low-complexity, unauthenticated attack with no user interaction, but impact is confined to availability (C:N/I:N) - matching CWE-191 (integer underflow) and a description that explicitly limits the outcome to crashing the DHCP client and loss of network connectivity. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is tempered by two factors: the adjacent-network requirement (not internet-routable) and the absence of code execution or data compromise. It should be treated as a patch-in-normal-cycle DoS issue, not an emergency, though BusyBox's enormous embedded/IoT footprint raises aggregate exposure. Note the 'Integer Overflow' tag versus the description and CWE-191, which both describe an integer UNDERFLOW - a labeling nuance, not a risk discrepancy. |
| Exploit ScenarioDerived | An attacker positioned on the same local network segment as a target device (e.g., a rogue host or compromised node on the same LAN/Wi-Fi) sends a specially crafted raw DHCP packet with a manipulated IP-header length field. The BusyBox udhcpc client trusts this attacker-controlled length without re-validating the minimum size, triggering an integer underflow and an oversized memory copy that crashes the client, dropping the device's network connectivity. No public exploit code is referenced in the available data, and exploitation requires no authentication or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Malformed raw DHCP packets can crash the udhcpc DHCP client shipped in BusyBox, causing denial of service and loss of network connectivity on the affected device until the client restarts or reacquires a lease. The flaw is reachable by any attacker with presence on the same Layer-2 segment as the victim (CVSS 3.1 AV:A/AC:L/PR:N/UI:N, 6.5 Medium) and requires no authentication and no user interaction; the assessed impact is availability-only (A:H) with no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation, and the adjacency requirement sharply limits the attacker population to those already on the local network, Wi-Fi, or VLAN. The first-sentence risk framing is that this is a moderate, availability-only vulnerability whose signals are internally consistent rather than conflicting.
RemediationAI
No vendor-released patch was identified at time of analysis, so the primary action is to track the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-88833 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2531347, and the upstream BusyBox project, for a fixed udhcpc release and then rebuild or update firmware and container images accordingly - hard coding a version number before it is published would be guesswork. Until a fix is available, the most effective control is to remove the attack surface from untrusted segments: enable DHCP snooping, dynamic ARP inspection, and port security on managed access switches so forged or injected DHCP frames from end hosts are dropped, accepting the operational cost that this requires managed switching and careful trusted-port configuration or it will break legitimate DHCP and guest access. Where the device supports it, replacing udhcpc with a different client (for example dhclient or systemd-networkd) eliminates the vulnerable code path, at the cost of a larger footprint that constrained firmware may not accommodate, and static IP configuration removes DHCP processing entirely at the cost of losing dynamic addressing. Segmentation is a strong compensating measure - place untrusted hosts, guest Wi-Fi, and IoT devices in separate VLANs with filtering against management and infrastructure subnets so adjacency is restricted to peers that are already trusted. On containerized deployments that use BusyBox, avoid host networking or run udhcpc in a dedicated network namespace so a client crash does not disrupt the host's networking stack, though this limits blast radius rather than fixing the bug. Finally, configure a process supervisor to restart udhcpc automatically (for example init respawn or a watchdog), which shortens the outage window but does not prevent the crash or stop an attacker from repeating it, so it should be treated as resilience rather than remediation. Note that these are compensating controls; only a patched udhcpc addresses the underlying integer underflow.
Affected ProductsAI
The affected component is the udhcpc DHCP client in BusyBox; any product that embeds BusyBox and uses udhcpc to obtain or renew leases inherits the exposure, which in practice means embedded Linux firmware, routers, IoT and CPE devices, and minimal container base images. The intelligence feed for this CVE provides no CPE strings and no explicit version range, so the precise set of affected BusyBox releases is not enumerated in the available data and must be confirmed against the upstream BusyBox project; Red Hat tracks its own shipped BusyBox instances - including those used in minimal container images - under https://access.redhat.com/security/cve/CVE-2026-88833 and https://bugzilla.redhat.com/show_bug.cgi?id=2531347. Devices that run udhcpc but never process raw DHCP packets are outside the exploitable configuration, and because the flaw is length-handling logic, builds that replace or patch the packet-receive routine may be unaffected even when the same BusyBox version string is present.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
udhcpc is BusyBox's small DHCP client, widely used in embedded Linux firmware, appliances, and minimal container images because it fits a single static binary. In the vulnerable path, the client reads a raw DHCP packet from the socket and uses the IP header's length field as the authoritative packet size, overwriting the already-validated length without re-checking that the packet meets the minimum size for the encapsulated headers. This is CWE-191 (integer underflow): subtracting the IP and transport header sizes from an attacker-supplied, undersized length wraps the length arithmetic to a near-maximum value, which is then handed to a memory copy as an oversized length. Because the attacker controls the offending field in a crafted packet - for example a spoofed or injected DHCP message delivered on the local segment while udhcpc is soliciting or renewing a lease - a device in normal DHCP operation will hit the flawed path without any local interaction. The result is memory corruption of the crash class rather than a controllable write, so the practical consequence is termination of the DHCP client, which on many embedded systems also means loss of IP configuration and connectivity. Exploitation is limited to adjacent attackers (AV:A); the flaw is not routable from the internet, and the description and the independent assessment agree there is no path to code execution, data disclosure, or integrity loss from this defect alone.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attacker must share the network segment (AV:A) but needs no auth or interaction (PR:N/UI:N); a crafted packet reliably triggers the crash (AC:L) with availability-only impact (C/I:N, A:H).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB