CVE-2026-26158
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A flaw was found in BusyBox allowing an attacker to modify files outside the intended extraction directory via a crafted tar archive with unvalidated hardlink or symlink entries. Extraction with elevated privileges can lead to privilege escalation.
Risk Assessment
An attacker could gain unauthorized access to critical system files, potentially leading to full system compromise if the archive is extracted with administrative privileges.
Recommendation
Update BusyBox to the patched version immediately and avoid extracting tar archives from untrusted sources with elevated privileges.
Other vulnerabilities in BusyBox
See all- CVE-2017-16544High
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature does not sanitize filenames, potentially leading to executing any escape sequences in the terminal.
- CVE-2011-5325High
Directory traversal vulnerability in the BusyBox implementation of tar before version 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.
- CVE-2016-2147High
Integer overflow in the DHCP client (udhcpc) in BusyBox before version 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, leading to an out-of-bounds heap write.
- CVE-2016-6301High
The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service via a forged NTP packet, triggering a communication loop.
- CVE-2022-48174Critical
A stack overflow vulnerability exists in ash.c:6030 in busybox before version 1.35. In the Internet of Vehicles environment, it can be exploited from command execution to arbitrary code execution.
- CVE-2026-76014Low
A vulnerability was found in BusyBox up to version 1.30.1 in the file networking/wget.c, in the FEATURE_WGET_TIMEOUT Handler component. Manipulation of the -T argument leads to a null pointer dereference. Local access is required. The exploit has been disclosed, and a patch is available (commit 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff).
- CVE-2026-38755Low
A heap overflow in the evalcommand() function (shell/ash.c) of BusyBox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
- CVE-2026-38754Medium
Heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0. An attacker can cause a Denial of Service (DoS) by supplying crafted input.
- CVE-2026-38752Low
A stack overflow vulnerability exists in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9. Attackers can cause a Denial of Service (DoS) by supplying a crafted AWK script.
- CVE-2026-38753Medium
A use-after-free vulnerability in the awk_sub() function (editors/awk.c) of BusyBox v1.38.0 allows attackers to cause a Denial of Service (DoS) by supplying a crafted AWK script.
Original NVD description (English source)
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.