CVE-2026-38754

MEDIUM

Busybox 1.38.0 - Denial of Service via Heap Overflow in ifsbreakup Function

Title source: llm
STIX 2.1

Description

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

References (4)

Core 4

Scores

CVSS v3 5.1
EPSS 0.0024
EPSS Percentile 14.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-122 CWE-125
Status published
Products (2)
busybox/busybox 1.38.0
BusyBox/BusyBox 1.00 - 1.38.0
Published Jul 15, 2026
Tracked Since Jul 16, 2026