Skip to main content

BusyBox CVE-2026-38753

MEDIUM
Use After Free (CWE-416)
2026-07-15 mitre
Denial Of Service Use After Free Memory Corruption Red Hat N A Suse
4.9
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
4.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
vuln.today AI
5.5 MEDIUM

Trigger is an attacker-supplied AWK program fed to the local interpreter, so AV:L and PR:L rather than AV:N/PR:N; impact is a crash only, so C/I:N and A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

6
Severity Changed
Jul 20, 2026 - 15:22 NVD
HIGH MEDIUM
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.5 (HIGH) 4.9 (MEDIUM)
Analysis Generated
Jul 16, 2026 - 16:23 vuln.today
CVSS changed
Jul 16, 2026 - 16:22 NVD
7.5 (HIGH)
CVE Published
Jul 15, 2026 - 00:00 cve.org
HIGH 7.5
CVE Published
Jul 15, 2026 - 00:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

AnalysisAI

Denial of service in BusyBox 1.38.0 arises from a use-after-free in the awk_sub() routine of the AWK applet (editors/awk.c), allowing an attacker who can supply a crafted AWK script to crash the busybox awk process. The flaw is a memory-corruption bug (CWE-416) with availability-only impact and no confidentiality or integrity consequences. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and its EPSS score is low (0.14%, 4th percentile).

Technical ContextAI

BusyBox bundles a compact AWK interpreter as one of its applets; awk_sub() in editors/awk.c implements the AWK sub()/gsub() substitution logic used during pattern-action script execution. The bug is a CWE-416 use-after-free, meaning a heap object (likely a string/regex or split-field buffer manipulated during substitution) is referenced after it has been freed, corrupting interpreter memory and typically causing a segfault. Because BusyBox is a single multi-call binary widely embedded in Linux firmware, containers, and appliances, the affected component is the awk applet rather than a standalone GNU awk build. The CPE string supplied (cpe:2.3:a:n/a:n/a:*) is a placeholder with no real vendor/product data, so exact affected-configuration enumeration relies on the description naming BusyBox v1.38.0.

RemediationAI

No vendor-released patched version is identified in the provided data; the only fix reference is an upstream BusyBox mailing-list thread (https://lists.busybox.net/pipermail/busybox/2026-June/092352.html), so treat this as an upstream fix discussion rather than a confirmed tagged release - rebuild BusyBox from the corrected editors/awk.c once the maintainers publish it and track the project site http://busybox.com for the next release beyond 1.38.0. As a compensating control, avoid running busybox awk on untrusted or attacker-influenced AWK scripts, and where awk processing of untrusted program text is unavoidable, sandbox or resource-limit the process (e.g., run under a restricted user with a memory/CPU cgroup so a crash is contained and auto-restarted). If the awk applet is not required, build BusyBox without it (disable CONFIG_AWK) to remove the attack surface entirely - the trade-off is loss of awk functionality for any scripts that depend on it.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.1 Affected

Share

CVE-2026-38753 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy