{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-124742","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","state":"PUBLISHED","assignerShortName":"redhat","dateReserved":"2026-11-09T11:36:29.478Z","datePublished":"2026-11-11T11:19:54.026Z","dateUpdated":"2026-11-13T13:32:57.527Z"},"containers":{"cna":{"title":"Busybox: divide-by-zero in the volume_id fat prober via a zero sectors_per_cluster value","metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Hardened Images","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"busybox-main","defaultStatus":"affected","versions":[{"version":"1.37.0-9.5.hum1","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:hummingbird:1"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"busybox","defaultStatus":"unknown","cpes":["cpe:/o:redhat:rhel_els:6"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:99577","name":"RHSA-2026:99577","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-124742","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571620","name":"RHBZ#2571620","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/vda-linux/busybox_mirror/commit/b7c89c4"}],"datePublic":"2026-11-11T09:15:15.000Z","problemTypes":[{"descriptions":[{"cweId":"CWE-369","description":"Divide By Zero","lang":"en","type":"CWE"}]}],"x_redhatCweChain":"CWE-369: Divide By Zero","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"timeline":[{"lang":"en","time":"2026-10-25T13:38:36.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-11-11T09:15:15.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Duc Anh Luu for reporting this issue."}],"providerMetadata":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-11-13T13:32:57.527Z"},"x_generator":{"engine":"cvelib 1.8.0"}}}}