CVE-2019-5747: busybox Out-of-bounds Read
Vulnerability summary
CVE-2019-5747 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in busybox. EPSS estimates a 4.65% chance of exploitation in the next 30 days, higher than 91.6% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 09-01-2019PublishedVulnerability first disclosed.
- 09-06-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.
CVSS metrics
7 scores · 5 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
4.65%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.65% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (bugs.busybox.net)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- busybox< 1.30.1-r2 | < 1.29.3-r10
Busybox1 product
- busybox≤ 1.30.0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
Debian1 product
- busybox< 1:1.30.1-2
Ubuntu1 product
- busybox< 1:1.21.0-1ubuntu1.4 | < 1:1.22.0-15ubuntu1.4 | < 1:1.27.2-2ubuntu3.2
5 vendors · 5 products
References
11 links- git.busybox.net/busybox/commit/?id=74d9f1ba37010face4bd1449df4d60dd84450b06X Refsource MISCPatchThird Party Advisory
- packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
