BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler. Network-adjacent attackers can exploit this vulnerability by sending crafted DHCPv6 responses with malformed D6_OPT_DNS_SERVERS options. The vulnerability exists in the option_to_env() function due to incorrect heap buffer allocation calculations. Successful exploitation can lead to memory corruption, denial of service, or arbitrary code execution. The vulnerability particularly affects embedded systems without heap hardening protections.