high advisory November 10, 2026

BusyBox: Heap-based buffer overflow in wget (CVE-2026-124747)

A flaw in the BusyBox wget utility allows remote attackers to trigger a heap-based buffer overflow via crafted FTP file size metadata, potentially leading to arbitrary code execution or denial of service.

Triage facts

Revision 1

Applicability: BusyBox
Evidence: Unknown
Severity: High
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Nov 10, 14:33 UTC
Vulnerabilities: 1 CVE
Source quality: A1Roughly even chance

BusyBox wget utility contains an integer calculation error when resuming FTP downloads. The utility fails to validate that the resume offset does not exceed the file size reported by the FTP server. An attacker operating a malicious FTP server or performing an on-path network attack can provide crafted file size metadata to trigger a heap-based buffer overflow. This can result in application crashes (DoS) or arbitrary code execution. No patch status is currently reported in the source.

Impact

Successful exploitation allows for remote code execution or denial of service of the BusyBox wget utility, impacting systems relying on BusyBox for network file transfers.

Recommendation

Audit network environments for reliance on BusyBox wget for FTP transfers, particularly in untrusted or external network segments.
Monitor for unexpected crashes of processes utilizing BusyBox wget.
Evaluate and deploy patches for BusyBox once released by the maintainers.

Immediate actions

Inventory all systems utilizing BusyBox wget for FTP file transfers

IT Operations 48h

Threat Hunt

Monitor system/application logs for abnormal crashes or segmentation faults of processes executing wget

T1190 medium medium confidence hunt now

Data: syslog, dmesg, application logs

Mitigations

Restrict outbound FTP traffic to trusted servers only

medium Network Engineering

CVE-2026-124747