{"id":"CVE-2026-124742","aliases":[],"cve":{"records":[{"id":"CVE-2026-124742","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-09T11:36:29.478Z","published":"2026-11-11T11:19:54.026Z","modified":"2026-11-13T13:32:57.527Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-13T13:32:57.527Z"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:99577","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-124742","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571620","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://github.com/vda-linux/busybox_mirror/commit/b7c89c4","tags":[],"source":"redhat"}],"weaknesses":[{"id":"CWE-369","description":"Divide By Zero","source":"redhat"}],"applicability":[],"prioritization":[]},"title":"Busybox: divide-by-zero in the volume_id fat prober via a zero sectors_per_cluster value","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations.","score":5.5,"severity":"medium","published":"2026-11-11T11:19:54.026Z","modified":"2026-11-13T13:32:57.527Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Hardened Images","platforms":[],"versions":[{"version":"1.37.0-9.5.hum1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:hummingbird:1"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-124742"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 6","platforms":[],"versions":[],"defaultStatus":"unknown","cpes":["cpe:/o:redhat:rhel_els:6"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-124742"}],"remediation":[{"text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-124742"}],"references":["https://access.redhat.com/errata/RHSA-2026:99577","https://access.redhat.com/security/cve/CVE-2026-124742","https://bugzilla.redhat.com/show_bug.cgi?id=2571620","https://github.com/vda-linux/busybox_mirror/commit/b7c89c4"],"sources":[{"name":"CVE","id":"CVE-2026-124742","modified":"2026-11-13T13:32:57.527Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-124742"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":5.5}],"sourceAffected":[],"observedAt":"2026-11-13T14:16:57.202Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-11T21:20:33.746Z","attemptedAt":"2026-11-11T21:20:33.746Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-11T21:20:33.600Z","attemptedAt":"2026-11-11T21:20:33.600Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-11T21:20:33.398Z","attemptedAt":"2026-11-11T21:20:33.398Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-11T21:20:32.893Z","attemptedAt":"2026-11-11T21:20:32.893Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-123359","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123359","modified":"Nov 11, 2026, 7:38:47 PM","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","checkedAt":"2026-11-11T21:20:33.398Z"},{"source":"GitHub Advisory Database","id":"GHSA-whhw-82c4-82xv","url":"https://github.com/advisories/GHSA-whhw-82c4-82xv","modified":"2026-11-11T12:31:49Z","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","checkedAt":"2026-11-11T21:20:33.600Z"},{"source":"NVD","id":"CVE-2026-124742","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124742","modified":"2026-11-11T12:19:47.993","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","checkedAt":"2026-11-11T21:20:33.746Z"}],"aiSummary":{"text":"BusyBox has a divide-by-zero flaw in the volume_id fat prober via a zero sectors_per_cluster value, allowing an attacker with crafted storage access to cause a Denial of Service (DoS) crash. The issue affects partition scanning utilities. Impact on specific versions is uncertain.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T14:21:05.016Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-124742"}]}}