{"id":"AZL-108321","summary":"CVE-2026-88833 affecting package busybox 1.36.1-27","details":"A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.","modified":"2026-10-20T05:35:13Z","published":"2026-10-13T17:17:48Z","upstream":["CVE-2026-88833"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88833"}],"affected":[{"package":{"name":"busybox","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/busybox"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.36.1-27"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108321.json"}}],"schema_version":"1.9.0"}