BusyBox CVE-2026-76014

Exploitation requires local shell access to a system running BusyBox 1.30.0 or 1.30.1 with FEATURE_WGET_TIMEOUT enabled at compile time. The attacker must be able to invoke the BusyBox wget applet and supply a -T argument value that causes the null pointer dereference when getopt32 processes the timeout option without a valid destination pointer. Systems where BusyBox was compiled without FEATURE_WGET_TIMEOUT are not vulnerable to this specific code path. CVSS PR:L confirms that at minimum local authentication or access is required; unauthenticated remote exploitation is not possible. The impact ceiling is a crash of the wget process only - no privilege escalation path has been identified. Factors limiting real-world exploitation: attacker must have existing local account access, the impact does not extend beyond the wget process, and many embedded BusyBox deployments are on versions outside the confirmed 1.30.0-1.30.1 window.

The CVSS 4.0 base score of 1.9 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) accurately captures the constrained impact: local access is required, confidentiality and integrity are wholly unaffected, and the only outcome is a low-severity crash of the wget process itself rather than the host. The E:P supplemental metric is set, consistent with the publicly disclosed proof-of-concept. This CVE is absent from the CISA KEV catalog, and no EPSS score was included in the source intelligence - exploitation probability is therefore unquantified but expected to be low given the local-only vector and trivial impact. Even a mid-sized municipal IT team in koszalin managing embedded BusyBox deployments would reasonably classify this as low-priority patching: an attacker must already hold local shell access, and the blast radius is limited to crashing wget rather than gaining elevated privileges or exfiltrating data. The main concern is multi-tenant embedded environments - shared IoT firmware, minimal container base images - where untrusted local users exist; in such contexts the patch should still be applied during the next maintenance cycle but warrants no emergency response.

A local user with shell access on an embedded Linux system - such as an IoT device, router, or Alpine-based container - running BusyBox 1.30.0 or 1.30.1 invokes wget with a crafted -T argument that triggers the null pointer dereference in the getopt32 timeout option handler, immediately crashing the wget process. A public proof-of-concept is available at https://gist.github.com/wyxstarry/5c199ec824928c5ae5816aaecbc6df03, lowering the skill threshold for reproduction. The practical impact is limited to disrupting wget - no code execution or privilege escalation has been demonstrated.