CVE-2026-88842

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-88842", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-10T09:52:23.527Z", "datePublished": "2026-10-14T10:02:05.270Z", "dateUpdated": "2026-10-15T19:33:22.460Z"}, "containers": {"cna": {"title": "Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption", "metrics": [{"other": {"content": {"value": "Low", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Hardened Images", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "busybox-main", "defaultStatus": "affected", "versions": [{"version": "1.37.0-9.4.hum1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:hummingbird:1"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:81391", "name": "RHSA-2026:81391", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-88842", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531355", "name": "RHBZ#2531355", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-10-14T08:45:24.684Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-125: Out-of-bounds Read", "workarounds": [{"lang": "en", "value": "Do not use BusyBox dpkg for package management on systems where package integrity is critical. Remove packages one at a time if BusyBox dpkg must be used. Upstream should reset field_start at the beginning of each stanza iteration in write_status_file()."}], "timeline": [{"lang": "en", "time": "2026-09-07T07:10:06.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-14T08:45:24.684Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-15T19:33:22.460Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-14T10:52:03.773503Z", "id": "CVE-2026-88842", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T10:52:14.893Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-88842", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-14T10:52:03.773503Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T10:52:10.160Z"}}], "cna": {"title": "Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption", "credits": [{"lang": "en", "value": "Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Low", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "1.37.0-9.4.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "busybox-main", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-09-07T07:10:06.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-14T08:45:24.684Z", "value": "Made public."}], "datePublic": "2026-10-14T08:45:24.684Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:81391", "name": "RHSA-2026:81391", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-88842", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531355", "name": "RHBZ#2531355", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Do not use BusyBox dpkg for package management on systems where package integrity is critical. Remove packages one at a time if BusyBox dpkg must be used. Upstream should reset field_start at the beginning of each stanza iteration in write_status_file()."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-15T19:33:22.460Z"}, "x_redhatCweChain": "CWE-125: Out-of-bounds Read"}}, "cveMetadata": {"cveId": "CVE-2026-88842", "state": "PUBLISHED", "dateUpdated": "2026-10-15T19:33:22.460Z", "dateReserved": "2026-09-10T09:52:23.527Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-10-14T10:02:05.270Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "busybox-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.37.0-9.4.hum1", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption."}], "id": "CVE-2026-88842", "lastModified": "2026-10-15T20:17:15.873", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-88842", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-14T10:52:03.773503Z", "version": "2.0.3"}}]}, "published": "2026-10-14T11:17:06.993", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:81391"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-88842"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531355"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.", "bugzilla": {"description": "busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption", "id": "2531355", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531355"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption."], "mitigation": {"lang": "en:us", "value": "Do not use BusyBox dpkg for package management on systems where package integrity is critical. Remove packages one at a time if BusyBox dpkg must be used. Upstream should reset field_start at the beginning of each stanza iteration in write_status_file()."}, "name": "CVE-2026-88842", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "busybox", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-14T08:45:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-88842\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88842"], "statement": "This vulnerability is rated as Low because the demonstrated impact is limited corruption of the dpkg status file (one stanza dropped) when busybox dpkg removes two packages in one invocation. It is a local issue and requires the victim to run the applet.\nFedora ships the dpkg applet in the busybox package (busybox dpkg), so the previous 'no deployment on Fedora/RHEL' Base 0.0 justification was incorrect. Red Hat Hardened Images (Hummingbird) also ship busybox and remain affected. RHEL 8, 9, and 10 do not ship busybox in the product compose; that absence belongs in product affectedness, not in a 0.0 base score. Finding 7 (CVE-2026-88835) is in the same file and remains 6.1 because that path is a reliable crash.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[1.37.0-9.4.hum1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Hardened Images", "source": "cna", "vendor": "Red Hat"}, "product": "hardened_images", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "product": "hummingbird", "vendor": "redhat"}], "created": "2026-10-14T15:15:02.664245+00:00", "updated": "2026-10-26T09:45:03.293123+00:00", "vendors": ["redhat", "redhat$PRODUCT$hardened_images", "redhat$PRODUCT$hummingbird"]}