CVE-2026-38752

2.9 lowEPSS 0.2%

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

Severity

CVSS 3.1

2.9 low

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
CWEs: CWE-674, CWE-121
Published: 2026-07-15
Modified: 2026-07-20
Record from: the NVD, synced 2026-10-19

Affected

busybox:busybox

References

https://busybox.net/
https://lists.busybox.net/pipermail/busybox/2026-June/092351.html

Check your stack JSON