BusyBox: httpd stack-based buffer overflow (CVE-2026-124739)
BusyBox httpd is vulnerable to a stack-based buffer overflow when processing subdirectory configuration files containing an overly long index page name, potentially allowing local attackers to achieve arbitrary code execution or denial of service.
CVE search metadata
CVE search record: CVE-2026-124739. Severity: high. CVSS: 7.5. KEV: no. Product: BusyBox. Brief: BusyBox: httpd stack-based buffer overflow (CVE-2026-124739). Brief link: https://feed.craftedsignal.io/briefs/2026-11-busybox-buffer-overflow-cve-2026-124739/
Triage facts
Revision 1- Applicability
- BusyBox
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 20:04 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
A stack-based buffer overflow vulnerability (CVE-2026-124739) exists in the BusyBox httpd web server component. The vulnerability occurs when the service processes subdirectory configuration files, specifically triggered by an excessively long index page name.
Impact
Successful exploitation allows an attacker who already possesses write access to a subdirectory configuration file to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the web server process. The CVSS v3.1 base score for this vulnerability is 7.5.
Recommendation
Detection engineers should audit systems running BusyBox httpd for unusual modifications to configuration files. If your environment uses BusyBox, verify the installed version and check the BusyBox project for patch availability or configuration workarounds to disable the vulnerable subdirectory index functionality if not required.
Threat Hunt
Monitor for unauthorized write access or modifications to httpd configuration files within web directory structures.
Data: File integrity monitoring (FIM) or auditd file access logs