BusyBox CVE-2026-38755

Exploitation requires the attacker to deliver crafted command input that reaches BusyBox 1.38.0's ash shell so that evalcommand() processes it - i.e., either the ability to invoke ash directly or an application/service that forwards attacker-controlled data into an ash instance. The impact is confined to a crash (availability only); there is no claimed code execution or data exposure. Limiting factors: the vulnerable code path is a local shell interpreter, so despite the published AV:N rating, practical remote exploitation depends on a deployment that specifically exposes ash to untrusted input - absent such a bridge, this is a local denial-of-service condition. No authentication requirement can be confirmed beyond the vector's PR:N, which is itself questionable given the local nature of the component.

The signals are mixed and warrant scrutiny. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H, score 7.5) rates this as network-reachable, unauthenticated, and low-complexity - yet the vulnerable component is a local shell interpreter that must be fed 'crafted input,' which typically implies local shell invocation or an application that pipes untrusted data into ash. This is a notable conflict: the network attack vector is only realistic where a service exposes ash to attacker-controlled input; otherwise this behaves as a local DoS - verify the exposure path with the vendor. EPSS is low (0.16%) and there is no KEV listing and no public exploit identified, consistent with a low-urgency, availability-only bug. SSVC-style reading: technical impact is partial (crash/DoS, no code execution claimed), automatability is unclear, and exploitation is not observed. Net: real but low priority for most deployments - patch on a normal cycle rather than as an emergency, unless you run ash against untrusted network input.

An attacker who can supply command input to a BusyBox ash shell - for example through a network-facing service, management interface, or automation hook that forwards user-controlled data to the shell - sends a specially crafted command string that overruns a heap buffer inside evalcommand(). The shell process crashes, denying service; on constrained embedded or container systems this can take down the affected function or device. No public proof-of-concept is available at time of analysis.