CVE-2026-124739
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 11, 2026
Vendor
unknown
Description
A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the server process.