BusyBox CVE-2026-38752

Exploitation requires the attacker to control the AWK script that BusyBox's awk applet parses and executes - specifically a crafted script that drives the evaluate() routine in editors/awk.c to overflow the stack. This is only reachable where busybox awk is fed attacker-supplied or attacker-influenced script content (e.g., a service that accepts and runs user AWK, or a pipeline processing untrusted scripts); in the common case where awk runs only fixed, operator-provided scripts, an external attacker has no path to trigger it. Limiting factors: the vulnerable input is the script, not ordinary data awk processes, so mere ability to send text to an awk-backed service is not sufficient unless that text is executed as a script; impact is confined to crashing the awk process (availability only, no code execution or data disclosure). Note the NVD vector claims AV:N/PR:N, but the description's 'supplying a crafted AWK script' prerequisite implies at least local or privileged script-supply access - verify with the vendor.

The signals conflict and lean toward lower real-world priority than the 7.5/High NVD score suggests. NVD's vector (AV:N/AC:L/PR:N/UI:N/A:H) treats this as remote, unauthenticated, and network-reachable, but the description requires 'supplying a crafted AWK script' - awk only runs a script the attacker already controls, which is fundamentally a local/self-inflicted or code-you-provide condition rather than remote unauthenticated attack surface. That mismatch means the AV:N and PR:N assignments are questionable - verify with the vendor/report. Corroborating the low practical risk: EPSS is 0.16% (6th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis. Impact is confined to availability (C:N/I:N/A:H) - a crash of the awk process, not RCE and not necessarily whole-system DoS. Net: a genuine robustness bug worth patching in embedded/long-lived deployments, but not an emergency; the primary danger is where busybox awk is exposed to untrusted script content (e.g., a service that runs user-supplied AWK), which is an uncommon configuration.

An attacker who can influence which AWK script BusyBox executes - for example a CGI endpoint, log processor, or automation hook that runs user-supplied AWK - submits a script with pathologically deep recursion or nested expressions. When busybox awk evaluates it, evaluate() recurses past the stack limit and the process crashes, denying the dependent service. No public exploit is currently available, and the crafted script must reach the awk interpreter for the crash to occur.