CVE-2026-88835

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-88835", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-10T09:42:04.559Z", "datePublished": "2026-09-23T17:45:27.703Z", "dateUpdated": "2026-09-25T22:28:21.858Z"}, "containers": {"cna": {"title": "Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Hardened Images", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "busybox-main", "defaultStatus": "affected", "versions": [{"version": "1.37.0-9.1.hum1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:hummingbird:1"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:72111", "name": "RHSA-2026:72111", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-88835", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531349", "name": "RHBZ#2531349", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-23T16:35:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-125: Out-of-bounds Read", "workarounds": [{"lang": "en", "value": "Do not use the BusyBox dpkg applet to process untrusted .deb packages. Use the full dpkg implementation if Debian package handling is needed."}], "timeline": [{"lang": "en", "time": "2026-09-09T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-23T16:35:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-25T22:28:21.858Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-25T18:14:56.514596Z", "id": "CVE-2026-88835", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T18:15:10.250Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages", "credits": [{"lang": "en", "value": "Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "packageName": "busybox", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-09-09T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-23T16:35:00.000Z", "value": "Made public."}], "datePublic": "2026-09-23T16:35:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-88835", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531349", "name": "RHBZ#2531349", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Do not use the BusyBox dpkg applet to process untrusted .deb packages. Use the full dpkg implementation if Debian package handling is needed."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-24T17:58:23.335Z"}, "x_redhatCweChain": "CWE-125: Out-of-bounds Read"}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-88835", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-25T18:14:56.514596Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-09-25T18:15:02.072Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-88835", "state": "PUBLISHED", "dateUpdated": "2026-09-24T17:58:23.335Z", "dateReserved": "2026-09-10T09:42:04.559Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-09-23T17:45:27.703Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "busybox-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.37.0-9.1.hum1", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read."}], "id": "CVE-2026-88835", "lastModified": "2026-09-25T23:16:54.683", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-88835", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-25T18:14:56.514596Z", "version": "2.0.3"}}]}, "published": "2026-09-23T18:17:10.350", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:72111"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-88835"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531349"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "busybox: busybox: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages", "id": "2531349", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531349"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read."], "mitigation": {"lang": "en:us", "value": "Do not use the BusyBox dpkg applet to process untrusted .deb packages. Use the full dpkg implementation if Debian package handling is needed."}, "name": "CVE-2026-88835", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "busybox", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-23T16:35:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-88835\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88835"], "statement": "This flaw allows a crafted .deb package to crash the BusyBox dpkg applet or potentially leak adjacent heap memory. Fedora uses RPM as its package management format, and the BusyBox dpkg applet has no practical deployment scenario on Fedora systems.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "product": "busybox", "vendor": "busybox"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "Red Hat Hardened Images", "source": "cna", "vendor": "Red Hat"}, "product": "hardened_images", "vendor": "redhat"}], "created": "2026-09-23T20:00:09.002170+00:00", "updated": "2026-09-24T09:10:32.544045+00:00", "vendors": ["busybox", "busybox$PRODUCT$busybox", "redhat", "redhat$PRODUCT$hardened_images"]}