BusyBox dpkg CVE-2026-88835

Exploitation requires a BusyBox build with the dpkg applet compiled in (not enabled in many default/minimal BusyBox configurations), and a victim must actively invoke BusyBox dpkg to parse an attacker-supplied malformed .deb package (UI:R). Access is local (AV:L) with no authentication required (PR:N), so the practical prerequisites are: delivering the crafted .deb to the target and inducing the user or an automated pipeline to process it with the vulnerable applet. Limiting factors: required user/pipeline interaction, dependence on the non-default dpkg applet, local (not remote-network) attack surface, and impact largely limited to a crash with only minor heap information disclosure.

This is a genuine but moderate-priority local memory-safety defect, not a critical remote flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, base 6.1) is internally consistent with the description: exploitation is local, requires no privileges but does require user interaction (a victim must process a malformed .deb with a BusyBox build whose dpkg applet is compiled in). The dominant impact is availability (A:H) from a crash on the out-of-bounds heap read, with only limited confidentiality (C:L) from potentially leaked adjacent heap bytes and no integrity impact - consistent with CWE-125 (out-of-bounds read) rather than a writable overflow. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Real-world risk is bounded by the need for local file processing, user interaction, and a non-default BusyBox configuration (dpkg applet). Note a data tension: the sole CPE is 'red_hat_hardened_images', but the actual vulnerable code is BusyBox's dpkg applet - the Red Hat Hardened Images entry is the reporting/distribution scope, and the true upstream component (BusyBox) is not reflected in the CPE, which understates the affected population and should be verified upstream.

An attacker crafts a malformed .deb package with a truncated or malformed package field and delivers it to a victim (e.g., via download or a build pipeline). When the victim runs BusyBox's dpkg applet against the file, read_package_field() reads past a NUL terminator, triggering an out-of-bounds heap read that crashes the process (DoS) and may leak small amounts of adjacent heap memory. No public exploit code was identified in the provided data.