What is the CVSS score of CVE-2026-38755?

CVE-2026-38755 has a CVSS 3.1 base score of 2.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of BusyBox are affected by CVE-2026-38755?

BusyBox 1.38.0 contains a denial-of-service vulnerability affecting embedded systems, IoT devices, and containerized environments.

How to fix or mitigate CVE-2026-38755?

Within 24 hours, inventory all systems running BusyBox 1.38.0, documenting network exposure and operational criticality. Within 7 days, implement compensating controls by restricting network access to affected systems, disabling or limiting ash shell functionality to trusted sources, and enhancing input validation for shell commands. Within 30 days, monitor the BusyBox project for security updates, establish a testing plan to upgrade affected systems to a patched release when available, and document alternative embedded tool suites as contingency options for long-lived deployments.

BusyBox CVE-2026-38755

EUVD-2026-44851 LOW

Heap-based Buffer Overflow (CWE-122)

2026-07-15 mitre

GHSA-jcqv-rj94-jmx3

Heap Overflow Buffer Overflow Denial Of Service N A

2.9

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

2.9 LOW

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.5 MEDIUM

The vulnerable ash interpreter processes locally supplied command input, so AV:L and PR:L are honest; impact is a crash only, giving A:H with C:N/I:N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Severity Changed

Jul 20, 2026 - 16:22 NVD

HIGH LOW

CVSS changed

Jul 20, 2026 - 16:22 NVD

7.5 (HIGH) 2.9 (LOW)

Analysis Generated

Jul 16, 2026 - 16:24 vuln.today

CVSS changed

Jul 16, 2026 - 16:22 NVD

7.5 (HIGH)

CVE Published

Jul 15, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Jul 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

AnalysisAI

Denial of service in BusyBox 1.38.0 stems from a heap-based buffer overflow in the evalcommand() routine of the ash shell interpreter (shell/ash.c), where crafted input corrupts heap memory and crashes the process. No public exploit identified at time of analysis, and the EPSS probability is low (0.16%, 6th percentile), indicating no observed exploitation activity. Impact is limited to availability - no confidentiality or integrity loss is claimed per the CVSS vector.

Technical ContextAI

BusyBox bundles dozens of stripped-down Unix utilities into a single binary and is a staple of embedded Linux, IoT firmware, container base images, and initramfs environments. The flaw lives in its 'ash' shell implementation (shell/ash.c), a lightweight POSIX-style command interpreter; specifically evalcommand(), the internal function that evaluates a parsed command node before execution. CWE-122 (heap-based buffer overflow) indicates the root cause is writing past the bounds of a dynamically allocated buffer on the heap - here triggered while the shell processes maliciously structured command input, corrupting heap metadata or adjacent allocations and crashing the interpreter.

RemediationAI

No vendor-released patched version is identified in the provided data, so a specific fixed release cannot be cited - track the BusyBox mailing list thread (https://lists.busybox.net/pipermail/busybox/2026-June/092354.html) and https://busybox.com for an upstream fix and upgrade to the first release above 1.38.0 that references CVE-2026-38755 once published. As compensating controls until a patch is available: avoid piping untrusted or network-sourced data into a BusyBox ash shell (route such input through a hardened, non-BusyBox interpreter or a validating parser instead); where a service invokes ash on attacker-influenced input, add strict input validation/length limits upstream, or replace the embedded ash usage with a full shell (e.g. dash/bash) if the platform allows - trade-off is a larger footprint. For appliances/IoT, restrict shell access to trusted local users only, accepting reduced remote-management convenience. Consult the NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-38755) and VulDB (https://vuldb.com/vuln/379430) entries for updated fix guidance.