BusyBox CVE-2026-88839

Exploitation requires local access to a system using BusyBox's passwd or group applets AND the ability to supply a malformed passwd/group entry that reaches tokenize() during field trimming. Because writing or controlling passwd/group data normally requires root or equivalent file-write privileges, the CVSS PR:H reflects that a would-be attacker must already hold elevated privileges - this is the primary limiting factor and makes it a hardening/defense-in-depth issue rather than remotely reachable. No network vector, no user interaction, and no default-configuration remote path exist; impact is confined to the local host (S:U).

This is a local, high-privilege memory-corruption bug (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 6.7) in BusyBox's passwd/group applet tokenize() path, where a stale endpoint pointer after field trimming leads to an out-of-bounds write of heap pointers (CWE-787). The CVSS vector is internally consistent with the description: exploitation is local (AV:L) and requires elevated privileges (PR:H), because triggering the malformed-entry parse realistically requires the ability to place crafted content into the passwd/group data that these applets tokenize - an action that on most systems already presupposes root or file-write authority. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no signal of active or automatable exploitation; the SSVC framework is not populated in the input. The full-triad C:H/I:H/A:H reflects the potential of controlled heap-pointer corruption to escalate to code execution, but the PR:H + AV:L gating makes this primarily a hardening/defense-in-depth concern rather than a mass-exploitation priority. Note the scoping tension: the CPE names only 'Red Hat Hardened Images', yet the defect is in upstream BusyBox itself, so the true affected population is far broader than the single CPE suggests - verify downstream exposure against your own BusyBox usage.

A local attacker (or a compromised low-integrity component that has gained the ability to influence passwd/group data) plants a malformed entry that BusyBox's passwd/group applet parses via tokenize(). During trimming, the routine reuses a stale endpoint pointer and performs an out-of-bounds heap write of pointer values, corrupting adjacent heap metadata and potentially steering execution. No public exploit code was identified at time of analysis.