{"id":"CVE-2026-124743","aliases":[],"cve":{"records":[{"id":"CVE-2026-124743","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-09T11:36:29.478Z","published":"2026-11-11T11:19:56.916Z","modified":"2026-11-13T17:10:15.378Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-11T20:27:57.065Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T17:10:15.378Z"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-124743","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571624","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"}],"weaknesses":[{"id":"CWE-369","description":"Divide By Zero","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T17:09:44.810151Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Busybox: divide-by-zero and heap over-read in the volume_id hfs+ prober","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly validate header values in HFS+ filesystems. An attacker able to attach a storage device or supply a specially crafted filesystem image can trigger an application crash, resulting in a Denial of Service (DoS) and preventing device resolution.","score":5.5,"severity":"medium","published":"2026-11-11T11:19:56.916Z","modified":"2026-11-13T17:10:15.378Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 6","platforms":[],"versions":[],"defaultStatus":"unknown","cpes":["cpe:/o:redhat:rhel_els:6"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-124743"},{"vendor":"Red Hat","name":"Red Hat Hardened Images","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:hummingbird:1"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-124743"}],"remediation":[{"text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-124743"}],"references":["https://access.redhat.com/security/cve/CVE-2026-124743","https://bugzilla.redhat.com/show_bug.cgi?id=2571624"],"sources":[{"name":"CVE","id":"CVE-2026-124743","modified":"2026-11-13T17:10:15.378Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-124743"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":5.5}],"sourceAffected":[],"observedAt":"2026-11-14T01:08:12.021Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-12T02:45:35.628Z","attemptedAt":"2026-11-12T02:45:35.628Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-12T02:45:35.772Z","attemptedAt":"2026-11-12T02:45:35.772Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-12T02:45:36.267Z","attemptedAt":"2026-11-12T02:45:36.267Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-12T02:45:35.410Z","attemptedAt":"2026-11-12T02:45:35.410Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-124743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124743","modified":"2026-11-11T12:19:48.150","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","checkedAt":"2026-11-12T02:45:35.628Z"},{"source":"GitHub Advisory Database","id":"GHSA-gjcv-9jxm-vqjv","url":"https://github.com/advisories/GHSA-gjcv-9jxm-vqjv","modified":"2026-11-11T12:31:49Z","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","checkedAt":"2026-11-12T02:45:35.772Z"},{"source":"ENISA EUVD","id":"EUVD-2026-123360","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123360","modified":"Nov 11, 2026, 8:27:57 PM","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","checkedAt":"2026-11-12T02:45:36.267Z"}],"aiSummary":{"text":"A divide-by-zero and heap over-read flaw in BusyBox's volume_id hfs+ prober can cause a crash when processing specially crafted HFS+ filesystems, potentially leading to a Denial of Service (DoS). An attacker must be able to attach a storage device or supply a crafted filesystem image. The impact is a device resolution prevention.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-11T21:36:06.151Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-124743"}]}}