{"id":"AZL-113945","summary":"CVE-2026-124737 affecting package busybox 1.36.1-28","details":"A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing the application.","modified":"2026-11-15T14:16:45.105595788Z","published":"2026-11-11T10:16:43Z","upstream":["CVE-2026-124737"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124737"}],"affected":[{"package":{"name":"busybox","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/busybox"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.36.1-28"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113945.json"}}],"schema_version":"1.9.2"}