BusyBox tar EUVD-2026-95914

Exploitation requires that busybox's tar applet be used to extract an attacker-controlled archive, AND that the extraction run with elevated (e.g. root) privileges - this is the explicit precondition for the privilege-escalation/code-execution outcome. The malicious archive must contain a symlink entry whose target is exactly '..' combined with a deferred hardlink entry (the unsafe deferred link-creation path), or must exploit reuse of the same extraction directory across two archives to replace a file outside it. Limiting factors: the vector is local (AV:L) with no network reach; a privileged user or process must actively perform the extraction (UI:R); and the specific archive construction plus directory-reuse timing make this high-complexity (AC:H). Extractions performed as an unprivileged user, or of trusted archives only, are not meaningfully at risk.

This is a moderate-severity local privilege-escalation/code-execution flaw (provided CVSS 3.1 base 6.3, CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H, CWE-59 link following) that should be treated as a patch-in-normal-cycle issue rather than an emergency. The signals are internally consistent: AV:L plus UI:R means an attacker cannot reach the target remotely - a privileged user or automated process must be induced to extract a malicious archive - and AC:H reflects the non-trivial preconditions (a precisely crafted symlink target of exactly '..' paired with a deferred hardlink, or reuse of an extraction directory across two archives). No EPSS score was provided, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The headline risk (I:H/A:H, privilege escalation or arbitrary code execution) only materializes 'if the archive is extracted with elevated privileges,' which is the dominant risk gate. Net: a real but conditional integrity/availability risk whose high theoretical impact is tempered by local vector, required user interaction, high attack complexity, and absence of exploitation signals - prioritize where busybox tar runs as root over untrusted archives (CI/CD, container build, package tooling).

An attacker supplies a malicious tar archive to a system or pipeline that extracts it as root using busybox tar (for example an automated container-image or firmware build step). The archive contains a symlink entry whose target is exactly '..' together with a deferred hardlink entry, so when the deferred link is created the resolved destination escapes the extraction directory and writes or replaces a file outside it, yielding privilege escalation or code execution. No public exploit code is identified, and successful exploitation requires the victim to perform the privileged extraction (UI:R).