BusyBox CVE-2026-38753

Exploitation requires that BusyBox 1.38.0's awk applet be invoked to execute an attacker-crafted AWK script that exercises the sub()/gsub() substitution path in awk_sub(); the malicious input is the AWK program itself, not merely data. This is fundamentally limited by the need for the target to run busybox awk on attacker-influenced script text - a condition normally present only where awk programs are dynamically constructed from or supplied by untrusted sources. The published vector's AV:N/PR:N/UI:N implies remote unauthenticated triggering, but the mechanism implies a local or input-supply position; verify with the vendor thread. Impact is confined to a crash (availability only) with no confidentiality or integrity effect.

The signals are mixed and lean toward low real-world urgency despite the 7.5 'High' NVD score. The published CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) treats this as remote, unauthenticated, low-complexity - but that contradicts the mechanism: exploitation requires the victim to run busybox awk on an attacker-supplied AWK *script*, which is normally a local/trusted input rather than network-delivered, so AV:N is questionable and likely inflates the score. Impact is availability-only (a crash/DoS); there is no code execution or data exposure claimed. EPSS is very low (0.14%), there is no KEV listing and no public POC identified, and SSVC-style automatable exploitation is unlikely because the trigger is a specially crafted program fed to the interpreter. Net: this is a real bug worth patching in build pipelines, but it is a limited-impact DoS, not an emergency - treat as routine hygiene unless BusyBox awk is exposed to untrusted script input in your environment.

An attacker who can influence which AWK program a system runs - for example a script or firmware component that passes attacker-controlled text to busybox awk - supplies a crafted script that triggers the use-after-free in awk_sub(), causing the awk process to crash. Where that awk invocation is part of a service or automated pipeline, the repeated crash results in denial of service for that function. No public POC is identified, and the impact is limited to availability with no code execution claimed.