CVE-2026-38754

5.1 mediumEPSS 0.2%

Medium (5.1) in busybox busybox. EPSS 0.2% chance of exploitation in the next 30 days.

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Severity

CVSS 3.1

5.1 medium

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWEs: CWE-125, CWE-122
Published: 2026-07-15
Modified: 2026-07-22
Record from: the NVD, synced 2026-10-19

Affected

busybox:busybox

References

https://busybox.net
https://lists.busybox.net/pipermail/busybox/2026-June/092353.html
https://lists.busybox.net/pipermail/busybox/2026-June/092360.html

Check your stack JSON