Busybox
Monthly
Path-restriction bypass in BusyBox httpd's reverse proxy feature allows unauthenticated remote attackers to reach backend paths outside the configured forwarding prefix. When URL-prefix proxying is configured, only the first request on a TCP connection has its path rewritten; a pipelined second request is relayed verbatim, defeating the intended prefix restriction and exposing arbitrary backend routes. Affects BusyBox httpd deployments, including Red Hat Hardened Images, that enable the non-default reverse proxy directive; no public exploit identified at time of analysis. CVSS 3.1 base score 7.2 (High) reflects network reachability, low complexity, no privileges or user interaction, and changed scope impacting the proxied backend.
Arbitrary file write outside the intended extraction directory is possible in BusyBox's dpkg-deb applet because its ar archive handler flushes deferred symlinks after every archive member rather than once after the final member. A crafted .deb containing two data.tar members - the first declaring a symlink to an absolute path such as '/', the second declaring a regular file whose path traverses that now-live link - causes a file to be written at an attacker-chosen location when the package is unpacked (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-59). Affected systems are BusyBox builds compiled with dpkg-deb support, including BusyBox shipped inside Red Hat Hardened Images; the CVSS vector indicates no privileges are required by the attacker (PR:N) but the victim must interact by extracting the untrusted package, and the vector's local attack value plus the non-trivial two-member structure keep this a context-dependent integrity issue rather than a mass-exploitation emergency. No public exploit identified at time of analysis.
A heap buffer overflow in BusyBox's romfs filesystem image parsing path can be triggered when the utility processes an attacker-crafted romfs image whose volume ID metadata is read with an unbounded strlen, producing an out-of-bounds heap write (CWE-787) rated CVSS 3.1 base 7.3. Because the attack vector is local (AV:L), the malicious image must be delivered to the target system - for example via removable media, a downloaded archive, a firmware/container image, or a package - and some process or user must then parse or mount it (UI:R); it is not remotely triggerable over a network. Under the assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) no privileges are required, and successful corruption could yield code execution in the context of the parsing process with high impact to confidentiality, integrity, and availability; no public exploit or POC was identified in the supplied intelligence and there is no confirmed active exploitation.
Pre-authentication heap memory corruption in BusyBox's built-in TLS implementation can be triggered by a remote, unauthenticated attacker who sends a single crafted ClientKeyExchange handshake message to a BusyBox process acting as a TLS server, corrupting the heap and crashing the process (CVSS 3.1 base 7.5, availability-only with no confidentiality or integrity impact rated). Exploitation requires a BusyBox binary compiled with TLS support and reachable in a server role, a deployment pattern that is the exception rather than the norm since BusyBox TLS is most often used outbound (for example by wget https), which sharply narrows the realistically exposed population. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence; the issue is tracked by Red Hat via its CVE page and Bugzilla, with no public exploit identified at time of analysis.
Arbitrary file creation in BusyBox's libarchive component allows attackers to write files outside the intended extraction directory by supplying a crafted archive containing symlink or traversal path entries, triggered when a target user opens the malicious file (ZDI-CAN-27556). The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R scores 6.1, reflecting a local attack path that requires user interaction, no confidentiality impact, high integrity impact, and low availability impact, with writes confined to the privileges of the extracting process. No public exploit code has been identified at time of analysis, and real-world priority is low-to-moderate except in automated or server-side pipelines that unpack untrusted archives without human vetting.
Removing two packages in a single BusyBox dpkg invocation can silently drop the second package's stanza from the dpkg status file when the first package's stanza is larger than the second, leaving the package database inconsistent with what is actually installed. Only environments that compile in and actually use the BusyBox dpkg applet are affected - Red Hat lists Red Hat Hardened Images, whose minimal footprint typically relies on BusyBox applets, and any other image built with CONFIG_DPKG enabled. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, score 3.3) requires local execution plus a human performing the removal, yields integrity-only impact on the status file with no confidentiality or availability effect, and no public exploit or code execution path has been identified at time of analysis.
Local, authenticated non-root users can bypass nosuid, nodev, and noexec mount restrictions enforced via /etc/fstab in BusyBox's mount utility by supplying clearing-mask options on the command line, potentially leading to integrity violations such as executing setuid programs or device access. The flaw requires a specific configuration where an fstab entry permits the user to mount a device and relies on those protections; it is not remotely exploitable. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is not provided.
Username enumeration in BusyBox httpd lets unauthenticated remote attackers distinguish valid from invalid account names when the daemon is built with non-default compile options (for example, without shadow password support) or operates with uncommon password-file states and is configured to use system password authentication. The weakness is an observable discrepancy (CWE-203) in how authentication failures are reported or timed for existing versus non-existing users; default BusyBox builds with shadow password support are explicitly not affected, so exposure is narrow and the impact is confined to information disclosure with no credential compromise, data modification, or denial of service. The assessed CVSS 3.1 base score is 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting high attack complexity and the need to reliably observe failure behavior; no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV).
Local privilege escalation and arbitrary code execution in the BusyBox tar applet (CVE-2026-108119) allow an attacker who supplies a crafted tar archive to create or replace files outside the extraction directory when the archive is extracted with elevated privileges. The flaw is a CWE-59 link-following issue in the applet's deferred symlink/hardlink creation path, with a CVSS 3.1 base score of 6.3 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), affecting BusyBox as shipped in Red Hat Enterprise Linux 6 and Red Hat Hardened Images. No public exploit identified at time of analysis; exploitation requires a privileged user or process to actively extract the malicious archive, and the specific archive construction plus directory-reuse timing makes this high-complexity and local-only.
An out-of-bounds read in BusyBox's built-in TLS handshake parser (get_client_hello()) lets unauthenticated remote attackers trigger a limited memory over-read by sending a malformed, truncated TLS ClientHello to a BusyBox process that parses inbound handshake data. Impact is confined to low confidentiality loss (CVSS 5.3, C:L) with no integrity or availability effect, and exploitation requires the atypical configuration of BusyBox acting as a TLS server or handshake receiver, since BusyBox's TLS code is most often used client-side for wget/https. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and Red Hat tracks the issue for Red Hat Hardened Images (advisory: https://access.redhat.com/security/cve/CVE-2026-88840; Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2531354).
Out-of-bounds write in BusyBox's passwd and group applets allows an authenticated attacker with high privileges (PR:H) to corrupt heap memory via a stale endpoint pointer after field trimming. The vulnerability (CVSS 6.7, CWE-787) is local-only (AV:L), requires no user interaction (UI:N), and is confined to the host (S:U), meaning a would-be attacker must already hold root or equivalent privileges to supply the malformed passwd/group entry. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was provided; the primary limiting factor is the PR:H requirement, which makes this a defense-in-depth hardening issue rather than a remotely reachable attack.
Authentication bypass in BusyBox httpd occurs when the server is configured with HTTP Basic Authentication backed by yescrypt ($y$-prefixed) password hashes, which the daemon fails to recognize as hashes and instead compares literally as plaintext - inverting the auth check so the stored hash string itself becomes a usable credential. The flaw is network-reachable and requires no prior authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, 6.5), with high attack complexity reflecting the dependency on the non-universal yescrypt configuration and the attacker's need to know or obtain the stored hash; impact skews to confidentiality (C:H) with limited integrity effect (I:L). Exposure is concentrated in Red Hat Hardened Images and other deployments where BusyBox httpd actually fronts authentication; there is no public exploit identified at time of analysis and no CISA KEV listing, so this is a configuration-gated weakness rather than a demonstrated in-the-wild attack.
An out-of-bounds heap read in BusyBox's dpkg applet (read_package_field()) allows a local attacker who supplies a malformed .deb package to crash the dpkg process and potentially expose a small amount of heap memory, since the assessed vector rates availability impact as High and confidentiality impact as Low (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, 6.1 Medium). Exploitation is constrained: it requires a BusyBox build with the dpkg applet compiled in (a non-default option in many minimal configurations, though it is present in the Red Hat Hardened Images builds tracked under the associated CPE) and requires the victim or an automated pipeline to actively invoke BusyBox dpkg against the crafted package. No public exploit identified at time of analysis, and no EPSS data was provided for this CVE; Red Hat is tracking the defect for Red Hat Hardened Images.
IP-based deny rules in BusyBox httpd can be silently bypassed: when an administrator configures an access-control rule with an invalid CIDR prefix length, the parser zeroes the netmask so the rule matches no clients and the intended block never takes effect. The flaw is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3), but it only manifests under that administrator-side precondition, so exposure is limited to deployments whose httpd configuration contains malformed deny entries - Red Hat Hardened Images are identified as affected via the published CPE. Impact is confined to confidentiality loss through bypass of the intended IP restriction, and no public exploit identified at time of analysis.
BusyBox wget's FEATURE_WGET_TIMEOUT handler in networking/wget.c crashes with a null pointer dereference when the -T (timeout) argument is processed, affecting versions 1.30.0 and 1.30.1. Local users who can invoke BusyBox wget can trigger a denial-of-service crash of the wget process by supplying a crafted -T argument value, exploiting an unguarded pointer dereference in the shared getopt32 option-parsing library. No public exploit has confirmed active production exploitation, but a public proof-of-concept is available and the CVE is not listed in CISA KEV.
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Network-reachable BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 embed BusyBox 1.31.1 and are exposed to multiple known BusyBox weaknesses that can compromise confidentiality, integrity, and availability. The vendor's CVSS 4.0 score is 10.0, but our assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N with high C/I/A impact because exploitation depends on reaching a specific network-facing BusyBox service or applet whose identity is not confirmed. EPSS is 0.37% (29th percentile) and no public exploit identified at time of analysis.
In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences. Rated low severity (CVSS 3.2), this vulnerability is no authentication required. No vendor patch available.
A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&&. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. Rated medium severity (CVSS 5.3). Public exploit code available and no vendor patch available.
A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in BusyBox through 1.30.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation. Rated medium severity (CVSS 5.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 15.8%.
Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Path-restriction bypass in BusyBox httpd's reverse proxy feature allows unauthenticated remote attackers to reach backend paths outside the configured forwarding prefix. When URL-prefix proxying is configured, only the first request on a TCP connection has its path rewritten; a pipelined second request is relayed verbatim, defeating the intended prefix restriction and exposing arbitrary backend routes. Affects BusyBox httpd deployments, including Red Hat Hardened Images, that enable the non-default reverse proxy directive; no public exploit identified at time of analysis. CVSS 3.1 base score 7.2 (High) reflects network reachability, low complexity, no privileges or user interaction, and changed scope impacting the proxied backend.
Arbitrary file write outside the intended extraction directory is possible in BusyBox's dpkg-deb applet because its ar archive handler flushes deferred symlinks after every archive member rather than once after the final member. A crafted .deb containing two data.tar members - the first declaring a symlink to an absolute path such as '/', the second declaring a regular file whose path traverses that now-live link - causes a file to be written at an attacker-chosen location when the package is unpacked (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-59). Affected systems are BusyBox builds compiled with dpkg-deb support, including BusyBox shipped inside Red Hat Hardened Images; the CVSS vector indicates no privileges are required by the attacker (PR:N) but the victim must interact by extracting the untrusted package, and the vector's local attack value plus the non-trivial two-member structure keep this a context-dependent integrity issue rather than a mass-exploitation emergency. No public exploit identified at time of analysis.
A heap buffer overflow in BusyBox's romfs filesystem image parsing path can be triggered when the utility processes an attacker-crafted romfs image whose volume ID metadata is read with an unbounded strlen, producing an out-of-bounds heap write (CWE-787) rated CVSS 3.1 base 7.3. Because the attack vector is local (AV:L), the malicious image must be delivered to the target system - for example via removable media, a downloaded archive, a firmware/container image, or a package - and some process or user must then parse or mount it (UI:R); it is not remotely triggerable over a network. Under the assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) no privileges are required, and successful corruption could yield code execution in the context of the parsing process with high impact to confidentiality, integrity, and availability; no public exploit or POC was identified in the supplied intelligence and there is no confirmed active exploitation.
Pre-authentication heap memory corruption in BusyBox's built-in TLS implementation can be triggered by a remote, unauthenticated attacker who sends a single crafted ClientKeyExchange handshake message to a BusyBox process acting as a TLS server, corrupting the heap and crashing the process (CVSS 3.1 base 7.5, availability-only with no confidentiality or integrity impact rated). Exploitation requires a BusyBox binary compiled with TLS support and reachable in a server role, a deployment pattern that is the exception rather than the norm since BusyBox TLS is most often used outbound (for example by wget https), which sharply narrows the realistically exposed population. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence; the issue is tracked by Red Hat via its CVE page and Bugzilla, with no public exploit identified at time of analysis.
Arbitrary file creation in BusyBox's libarchive component allows attackers to write files outside the intended extraction directory by supplying a crafted archive containing symlink or traversal path entries, triggered when a target user opens the malicious file (ZDI-CAN-27556). The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R scores 6.1, reflecting a local attack path that requires user interaction, no confidentiality impact, high integrity impact, and low availability impact, with writes confined to the privileges of the extracting process. No public exploit code has been identified at time of analysis, and real-world priority is low-to-moderate except in automated or server-side pipelines that unpack untrusted archives without human vetting.
Removing two packages in a single BusyBox dpkg invocation can silently drop the second package's stanza from the dpkg status file when the first package's stanza is larger than the second, leaving the package database inconsistent with what is actually installed. Only environments that compile in and actually use the BusyBox dpkg applet are affected - Red Hat lists Red Hat Hardened Images, whose minimal footprint typically relies on BusyBox applets, and any other image built with CONFIG_DPKG enabled. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, score 3.3) requires local execution plus a human performing the removal, yields integrity-only impact on the status file with no confidentiality or availability effect, and no public exploit or code execution path has been identified at time of analysis.
Local, authenticated non-root users can bypass nosuid, nodev, and noexec mount restrictions enforced via /etc/fstab in BusyBox's mount utility by supplying clearing-mask options on the command line, potentially leading to integrity violations such as executing setuid programs or device access. The flaw requires a specific configuration where an fstab entry permits the user to mount a device and relies on those protections; it is not remotely exploitable. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is not provided.
Username enumeration in BusyBox httpd lets unauthenticated remote attackers distinguish valid from invalid account names when the daemon is built with non-default compile options (for example, without shadow password support) or operates with uncommon password-file states and is configured to use system password authentication. The weakness is an observable discrepancy (CWE-203) in how authentication failures are reported or timed for existing versus non-existing users; default BusyBox builds with shadow password support are explicitly not affected, so exposure is narrow and the impact is confined to information disclosure with no credential compromise, data modification, or denial of service. The assessed CVSS 3.1 base score is 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting high attack complexity and the need to reliably observe failure behavior; no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV).
Local privilege escalation and arbitrary code execution in the BusyBox tar applet (CVE-2026-108119) allow an attacker who supplies a crafted tar archive to create or replace files outside the extraction directory when the archive is extracted with elevated privileges. The flaw is a CWE-59 link-following issue in the applet's deferred symlink/hardlink creation path, with a CVSS 3.1 base score of 6.3 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), affecting BusyBox as shipped in Red Hat Enterprise Linux 6 and Red Hat Hardened Images. No public exploit identified at time of analysis; exploitation requires a privileged user or process to actively extract the malicious archive, and the specific archive construction plus directory-reuse timing makes this high-complexity and local-only.
An out-of-bounds read in BusyBox's built-in TLS handshake parser (get_client_hello()) lets unauthenticated remote attackers trigger a limited memory over-read by sending a malformed, truncated TLS ClientHello to a BusyBox process that parses inbound handshake data. Impact is confined to low confidentiality loss (CVSS 5.3, C:L) with no integrity or availability effect, and exploitation requires the atypical configuration of BusyBox acting as a TLS server or handshake receiver, since BusyBox's TLS code is most often used client-side for wget/https. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and Red Hat tracks the issue for Red Hat Hardened Images (advisory: https://access.redhat.com/security/cve/CVE-2026-88840; Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2531354).
Out-of-bounds write in BusyBox's passwd and group applets allows an authenticated attacker with high privileges (PR:H) to corrupt heap memory via a stale endpoint pointer after field trimming. The vulnerability (CVSS 6.7, CWE-787) is local-only (AV:L), requires no user interaction (UI:N), and is confined to the host (S:U), meaning a would-be attacker must already hold root or equivalent privileges to supply the malformed passwd/group entry. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was provided; the primary limiting factor is the PR:H requirement, which makes this a defense-in-depth hardening issue rather than a remotely reachable attack.
Authentication bypass in BusyBox httpd occurs when the server is configured with HTTP Basic Authentication backed by yescrypt ($y$-prefixed) password hashes, which the daemon fails to recognize as hashes and instead compares literally as plaintext - inverting the auth check so the stored hash string itself becomes a usable credential. The flaw is network-reachable and requires no prior authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, 6.5), with high attack complexity reflecting the dependency on the non-universal yescrypt configuration and the attacker's need to know or obtain the stored hash; impact skews to confidentiality (C:H) with limited integrity effect (I:L). Exposure is concentrated in Red Hat Hardened Images and other deployments where BusyBox httpd actually fronts authentication; there is no public exploit identified at time of analysis and no CISA KEV listing, so this is a configuration-gated weakness rather than a demonstrated in-the-wild attack.
An out-of-bounds heap read in BusyBox's dpkg applet (read_package_field()) allows a local attacker who supplies a malformed .deb package to crash the dpkg process and potentially expose a small amount of heap memory, since the assessed vector rates availability impact as High and confidentiality impact as Low (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, 6.1 Medium). Exploitation is constrained: it requires a BusyBox build with the dpkg applet compiled in (a non-default option in many minimal configurations, though it is present in the Red Hat Hardened Images builds tracked under the associated CPE) and requires the victim or an automated pipeline to actively invoke BusyBox dpkg against the crafted package. No public exploit identified at time of analysis, and no EPSS data was provided for this CVE; Red Hat is tracking the defect for Red Hat Hardened Images.
IP-based deny rules in BusyBox httpd can be silently bypassed: when an administrator configures an access-control rule with an invalid CIDR prefix length, the parser zeroes the netmask so the rule matches no clients and the intended block never takes effect. The flaw is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3), but it only manifests under that administrator-side precondition, so exposure is limited to deployments whose httpd configuration contains malformed deny entries - Red Hat Hardened Images are identified as affected via the published CPE. Impact is confined to confidentiality loss through bypass of the intended IP restriction, and no public exploit identified at time of analysis.
BusyBox wget's FEATURE_WGET_TIMEOUT handler in networking/wget.c crashes with a null pointer dereference when the -T (timeout) argument is processed, affecting versions 1.30.0 and 1.30.1. Local users who can invoke BusyBox wget can trigger a denial-of-service crash of the wget process by supplying a crafted -T argument value, exploiting an unguarded pointer dereference in the shared getopt32 option-parsing library. No public exploit has confirmed active production exploitation, but a public proof-of-concept is available and the CVE is not listed in CISA KEV.
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Network-reachable BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 embed BusyBox 1.31.1 and are exposed to multiple known BusyBox weaknesses that can compromise confidentiality, integrity, and availability. The vendor's CVSS 4.0 score is 10.0, but our assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N with high C/I/A impact because exploitation depends on reaching a specific network-facing BusyBox service or applet whose identity is not confirmed. EPSS is 0.37% (29th percentile) and no public exploit identified at time of analysis.
In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences. Rated low severity (CVSS 3.2), this vulnerability is no authentication required. No vendor patch available.
A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&&. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. Rated medium severity (CVSS 5.3). Public exploit code available and no vendor patch available.
A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in BusyBox through 1.30.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation. Rated medium severity (CVSS 5.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 15.8%.
Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.