A heap buffer overflow vulnerability in the BusyBox DHCPv6 client allows network-adjacent attackers to achieve memory corruption or remote code execution via malformed responses.

This is a heap-based buffer overflow (CWE-122) in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler, triggered by an incorrect heap allocation formula when processing a crafted D6_OPT_DNS_SERVERS option from an unauthenticated network-adjacent attacker.

A successful exploit against this vulnerability can lead to complete system compromise, unauthorized remote code execution, or persistent denial of service on embedded network devices. Given the CVSS score of 8.1, the flaw poses a severe risk to network infrastructure availability and data integrity, potentially allowing lateral movement within compromised local networks.

Immediate Action: Update BusyBox to include the upstream patches referenced in commit 42202bfb1e6ac51fa995beda8be4d7b654aeee2a and commit d368f3f7836d1c2484c8f839316e5c93e76d4409.

Proactive Monitoring: Monitor network segments for anomalous DHCPv6 traffic patterns, unexpected daemon crashes, or unauthorized DHCPv6 server responses.

Compensating Controls: Restrict network-adjacent access to trusted Layer 2 segments and implement strict port security measures to mitigate the threat of rogue DHCPv6 servers.

Public Exploit Available: Yes, a published PoC exists, cited in the technical write-up provided in the referenced exploit documentation.

The severity of this heap buffer overflow necessitates immediate remediation for all affected embedded systems and network appliances utilizing BusyBox. Administrators must integrate the provided source patches into their firmware build pipelines and deploy updated binaries without delay to mitigate potential remote code execution risks.