BusyBox dpkg-deb EUVD-2026-100951

Exploitation requires that the victim extract an attacker-supplied .deb package using BusyBox's dpkg-deb applet (the ar archive handler), and that BusyBox be compiled with dpkg-deb support enabled. The malicious package must be specifically crafted with two data.tar members - the first declaring a symlink to an absolute path (e.g., '/') and the second declaring a regular file whose path traverses that symlink. Limiting factors that reduce real-world risk: mandatory user interaction (UI:R - a local user or automated job must choose to unpack the untrusted package), local delivery of the crafted file, and the non-trivial multi-member archive structure; it does not affect the tar, cpio, or unzip handlers, which flush deferred symlinks only once after the final member.

This is a credible but context-dependent integrity issue rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) is internally consistent with the description: the 'attacker' supplies a malicious artifact but a local victim must actively extract it, so this is NOT remote unauthenticated exploitation despite PR:N. No EPSS score, KEV listing, or public POC was supplied, so there is no public exploit identified at time of analysis and no evidence of in-the-wild use - the signals point to a theoretical/latent risk, not an active campaign. The impact rating (C:H/I:H/A:H) is driven by the arbitrary-file-write-to-arbitrary-location primitive (CWE-59 symlink traversal), which can plausibly escalate to code execution by overwriting trusted files, justifying the high triad even though the root bug is a write primitive. Conflict to verify: the input Tags label this 'Information Disclosure', but the description and CWE-59 describe arbitrary file WRITE outside the extraction directory - these do not match, and the tag appears incorrect. Priority is moderate: exploitation requires a deliberately crafted two-member .deb and a user action, limiting opportunistic abuse, but the affected code (BusyBox) is extremely widely deployed, so patch in automated/CI pipelines that unpack untrusted .deb files.

An attacker publishes or delivers a crafted .deb package containing two data.tar members and convinces a victim (or an automated pipeline) to extract it with BusyBox's dpkg-deb applet. The first member plants a symlink to an absolute path such as '/', which BusyBox prematurely 'flushes'/materializes after that member, and the second member then writes a regular file whose path traverses the now-live symlink, landing outside the intended directory. No public exploit code is identified at time of analysis, but exploitation is deterministic given a correctly structured archive.