CVE-2026-88841

{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.", "bugzilla": {"description": "busybox: busybox: dpkg write_status_file() stale cursor causes out-of-bounds read and status file corruption", "id": "2539987", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539987"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["BusyBox dpkg write_status_file() does not reset a stale field cursor between package stanzas, causing out-of-bounds reads and status file corruption when removing multiple packages."], "mitigation": {"lang": "en:us", "value": "Do not use the BusyBox dpkg applet for package management on systems where package integrity is critical."}, "name": "CVE-2026-88841", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "busybox", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-23T16:35:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-88841\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88841"], "statement": "This flaw allows a crafted sequence of package removals to corrupt the BusyBox dpkg status file. Fedora uses RPM as its package management format, and the BusyBox dpkg applet has limited deployment on Fedora systems.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "busybox", "vendor": "busybox"}], "created": "2026-09-24T13:30:17.982849+00:00", "updated": "2026-09-24T14:00:08.509849+00:00", "vendors": ["busybox", "busybox$PRODUCT$busybox"]}