CVE Alert: CVE-2026-124747 – Red Hat

A flaw was found in BusyBox. When resuming a download over File Transfer Protocol (FTP), the wget utility fails to verify that the resume offset does not exceed the file size reported by the server, resulting in an integer calculation error. A malicious FTP server or an on-path network attacker can exploit this issue by returning crafted file size metadata, triggering a heap-based buffer overflow with attacker-controlled data. Successful exploitation may allow an attacker to execute arbitrary code or crash the application, resulting in a denial of service (DoS).

**Risk verdict:** This is a high-impact memory-corruption risk; urgency cannot be confirmed because KEV, SSVC, PoC and EPSS signals were not provided.

**Why this matters:** Successful exploitation could turn a download operation into code execution in the downloader’s process, or cause it to crash. The most realistic attacker goals are compromising a host that retrieves files from an attacker-controlled source, or disrupting that download workflow.

**Most likely attack path:** The attacker needs network access and must influence the FTP server response or intercept the connection; no existing account is required, but a user or automated process must initiate a resumable download. High attack complexity limits opportunity, and unchanged scope means further compromise depends on the process’s permissions and access rather than being automatic.

**Who is most exposed:** Systems using BusyBox in embedded, appliance, container or hardened-image deployments are relevant, particularly where scripts or operators resume FTP downloads. Exposure is lower where FTP is unused or downloads come only from tightly controlled sources.

Review BusyBox wget logs for FTP resume operations and unexpected failures.

Alert on outbound FTP connections to new or unapproved hosts.

Investigate abnormal file-size metadata, repeated resume attempts or downloader crashes.

Check for core dumps and service restarts following FTP downloads.

Mitigation and prioritisation

Apply the vendor’s fixed package update as soon as available; confirm coverage across embedded images and deployed instances.

Until patched, disable FTP resume and prefer authenticated, integrity-checked transfer methods.

Restrict outbound FTP to approved destinations; use trusted mirrors and network controls against interception.

Test download automation changes before rollout, and track any systems that cannot be updated promptly.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.