BusyBox romfs CVE-2026-88832

Requires local processing of an attacker-crafted romfs filesystem image by BusyBox: the attacker controls the romfs volume ID metadata, which is read with an unbounded strlen. Exploitation is limited by the local attack vector (AV:L) - the malicious image must reach the target - and by required user/process interaction (UI:R) to actually parse or mount the image; it is not remotely triggerable over a network. Only builds of BusyBox that include the romfs applet/parsing path are affected.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 7.3) frames this as a local, low-complexity heap buffer overflow (CWE-787 out-of-bounds write) requiring some privilege and user interaction, with high impact to confidentiality, integrity, and availability - consistent with memory corruption in a filesystem parser that can escalate to arbitrary code execution. No EPSS score, KEV listing, or SSVC decision data was supplied, and no public exploit is referenced, so there is no public exploit identified at time of analysis. The AV:L designation is the key limiter: exploitation depends on getting a victim (or a privileged process) to parse an attacker-crafted romfs image rather than remote network reach, which sharply narrows real-world exploitability versus a remote flaw of the same score. One point of tension worth verifying with the vendor: the description ('processing crafted filesystem images') implies the attacker mainly needs to supply a malicious image, which argues for PR:N with UI:R rather than the PR:L in the published vector. Overall this is a credible but conditional issue - high technical impact gated behind local access and the victim actually mounting/parsing a malicious image - not a drop-everything remote priority.

An attacker crafts a malicious romfs filesystem image with an oversized/unterminated volume ID field and delivers it to a target (e.g., a USB stick, downloaded image, or container/embedded-device firmware blob). When BusyBox parses the image, the unbounded strlen over the attacker-controlled volume metadata overflows a heap buffer, corrupting memory and potentially yielding code execution in the parsing process. No public exploit code is referenced at time of analysis.