{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-124743","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","state":"PUBLISHED","assignerShortName":"redhat","dateReserved":"2026-11-09T11:36:29.478Z","datePublished":"2026-11-11T11:19:56.916Z","dateUpdated":"2026-11-13T17:10:15.378Z"},"containers":{"cna":{"title":"Busybox: divide-by-zero and heap over-read in the volume_id hfs+ prober","metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly validate header values in HFS+ filesystems. An attacker able to attach a storage device or supply a specially crafted filesystem image can trigger an application crash, resulting in a Denial of Service (DoS) and preventing device resolution."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"busybox","defaultStatus":"unknown","cpes":["cpe:/o:redhat:rhel_els:6"]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"busybox","defaultStatus":"affected","cpes":["cpe:/a:redhat:hummingbird:1"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-124743","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571624","name":"RHBZ#2571624","tags":["issue-tracking","x_refsource_REDHAT"]}],"datePublic":"2026-11-11T09:15:15.000Z","problemTypes":[{"descriptions":[{"cweId":"CWE-369","description":"Divide By Zero","lang":"en","type":"CWE"}]}],"x_redhatCweChain":"CWE-369: Divide By Zero","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"timeline":[{"lang":"en","time":"2026-10-25T13:39:53.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-11-11T09:15:15.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Duc Anh Luu for reporting this issue."}],"providerMetadata":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-11-11T20:27:57.065Z"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-11-13T17:09:44.810151Z","id":"CVE-2026-124743","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-11-13T17:10:15.378Z"}}]}}