Skip to main content

BusyBox CVE-2026-38754

| EUVDEUVD-2026-44850 MEDIUM
Heap-based Buffer Overflow (CWE-122)
2026-07-15 mitre GHSA-jj7c-h3wm-vjfw
Buffer Overflow Denial Of Service Heap Overflow Red Hat N A Suse
5.1
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
5.1 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
vuln.today AI
5.5 MEDIUM

Reaching ash's field-splitting requires supplying input to a shell the attacker can invoke, implying local access at low privilege (AV:L/PR:L); impact is a crash, so availability-only (A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Lifecycle Timeline

6
Severity Changed
Jul 20, 2026 - 15:22 NVD
HIGH MEDIUM
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.5 (HIGH) 5.1 (MEDIUM)
Analysis Generated
Jul 16, 2026 - 16:24 vuln.today
CVSS changed
Jul 16, 2026 - 16:22 NVD
7.5 (HIGH)
CVE Published
Jul 15, 2026 - 00:00 cve.org
HIGH 7.5
CVE Published
Jul 15, 2026 - 00:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

AnalysisAI

Denial of service in BusyBox 1.38.0 lets attackers crash the bundled ash shell by supplying crafted input that triggers a heap-based buffer overflow (CWE-122) in the ifsbreakup() field-splitting routine of shell/ash.c. Only availability is impacted - there is no public exploit identified at time of analysis, and the EPSS score is low (0.16%, 6th percentile), indicating little observed exploitation interest so far. The NVD-assigned CVSS of 7.5 rests on a network attack vector that is not clearly supported by the description, which points to input being fed to a local shell.

Technical ContextAI

BusyBox is a single-binary suite of stripped-down Unix utilities widely embedded in Linux-based routers, IoT firmware, and minimal container images (notably Alpine Linux). The flaw sits in ash.c, BusyBox's Almquist shell (ash) implementation, specifically in ifsbreakup(), the function that performs IFS (Internal Field Separator) word/field splitting on shell input during parameter and command substitution expansion. CWE-122 (heap-based buffer overflow) identifies the root cause class: the routine writes past the bounds of a heap-allocated buffer while breaking input into fields, corrupting adjacent heap memory and crashing the shell process. The CPE string provided (cpe:2.3:a:n/a:n/a:*) is a placeholder with no usable vendor/product/version data, so exact affected-product identification comes from the description text (BusyBox v1.38.0) rather than structured CPE.

RemediationAI

No vendor-released patched version is independently confirmed from the available data - the BusyBox mailing-list reference (https://lists.busybox.net/pipermail/busybox/2026-June/092353.html) appears to be a discussion/report thread rather than a tagged release, so track the BusyBox project (https://busybox.com) and upstream git for a fixed 1.38.x build and upgrade once published. As compensating controls until a fix ships: avoid passing untrusted or attacker-controlled data into BusyBox ash scripts or interactive shells (e.g. do not feed unvalidated network input into shell command/parameter substitution), which removes the delivery path at the cost of reworking any pipeline that does so; where BusyBox is embedded in appliances or containers, restrict who can execute or supply scripts to the ash shell, and in container images consider using a non-BusyBox shell for any component that processes untrusted input. Because impact is limited to a crash of the shell process, ensure service supervisors restart critical processes to blunt the DoS effect. Consult the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-38754) and VulDB (https://vuldb.com/vuln/379429) for updates.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.1 Affected

Share

CVE-2026-38754 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy