{"id":"CVE-2026-124742","summary":"Busybox: divide-by-zero in the volume_id fat prober via a zero sectors_per_cluster value","details":"A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations.","modified":"2026-11-13T02:46:56.973505036Z","published":"2026-11-11T11:19:54.026Z","database_specific":{"cna_assigner":"redhat","cwe_ids":["CWE-369"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/124xxx/CVE-2026-124742.json"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-124742"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/124xxx/CVE-2026-124742.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124742"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571620"},{"type":"FIX","url":"https://github.com/vda-linux/busybox_mirror/commit/b7c89c4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vda-linux/busybox_mirror","events":[{"introduced":"0"},{"fixed":"b7c89c4"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"b7c89c4"}]}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-124742.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}