Vulnerability-Lookup

RHSA-2026:81391

Vulnerability from csaf_redhat - Published: 2026-10-12 17:14 - Updated: 2026-11-13 04:04

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Moderate

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: busybox: * busybox-1.37.0-9.4.hum1 (aarch64, s390x, x86_64) * busybox-petitboot-1.37.0-9.4.hum1 (aarch64, s390x, x86_64) * busybox-shared-1.37.0-9.4.hum1 (aarch64, s390x, x86_64) * busybox-1.37.0-9.4.hum1.src (src) Security Fix(es): busybox: * CVE-2026-108119

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-88842

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 10 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Low

CVE-2026-92205

A flaw was found in BusyBox. An attacker could leverage this vulnerability to create arbitrary files in unintended locations with the permissions of the target user. This issue occurs because the archive handling component fails to properly validate user-supplied file paths, allowing directory traversal through symbolic links when a user is tricked into processing a malicious archive.

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

CWE-59 - Improper Link Resolution Before File Access

Affected products

Fixed 10 products, the same list as for CVE-2026-88842

Threats

Impact Moderate

CVE-2026-108119

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly '..' combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it. If the archive is extracted with elevated privileges, this flaw can lead to privilege escalation or arbitrary code execution.

6.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

CWE-59 - Improper Link Resolution Before File Access

Affected products

Fixed 10 products, the same list as for CVE-2026-88842

Threats

Impact Moderate

CVE-2026-124745

A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system.

6.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-59 - Improper Link Resolution Before File Access

Affected products

Fixed 10 products, the same list as for CVE-2026-88842

Threats

Impact Moderate

References

25 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:81391	self
https://access.redhat.com/security/cve/CVE-2026-108119	external
https://access.redhat.com/security/updates/classi…	external
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-88842	external
https://access.redhat.com/security/cve/CVE-2026-92205	external
https://access.redhat.com/security/cve/CVE-2026-124745	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-88842	self
https://bugzilla.redhat.com/show_bug.cgi?id=2531355	external
https://www.cve.org/CVERecord?id=CVE-2026-88842	external
https://nvd.nist.gov/vuln/detail/CVE-2026-88842	external
https://access.redhat.com/security/cve/CVE-2026-92205	self
https://bugzilla.redhat.com/show_bug.cgi?id=2558404	external
https://www.cve.org/CVERecord?id=CVE-2026-92205	external
https://nvd.nist.gov/vuln/detail/CVE-2026-92205	external
https://www.zerodayinitiative.com/advisories/ZDI-…	external
https://access.redhat.com/security/cve/CVE-2026-108119	self
https://bugzilla.redhat.com/show_bug.cgi?id=2548611	external
https://www.cve.org/CVERecord?id=CVE-2026-108119	external
https://nvd.nist.gov/vuln/detail/CVE-2026-108119	external
https://access.redhat.com/security/cve/CVE-2026-124745	self
https://bugzilla.redhat.com/show_bug.cgi?id=2571637	external
https://www.cve.org/CVERecord?id=CVE-2026-124745	external
https://nvd.nist.gov/vuln/detail/CVE-2026-124745	external

Acknowledgments

Causal Security Shubham Raj

TAE3

Duc Anh Luu

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nbusybox:\n  * busybox-1.37.0-9.4.hum1 (aarch64, s390x, x86_64)\n  * busybox-petitboot-1.37.0-9.4.hum1 (aarch64, s390x, x86_64)\n  * busybox-shared-1.37.0-9.4.hum1 (aarch64, s390x, x86_64)\n  * busybox-1.37.0-9.4.hum1.src (src)\n\nSecurity Fix(es):\n\nbusybox:\n  * CVE-2026-108119",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:81391",
        "url": "https://access.redhat.com/errata/RHSA-2026:81391"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-108119",
        "url": "https://access.redhat.com/security/cve/CVE-2026-108119"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-88842",
        "url": "https://access.redhat.com/security/cve/CVE-2026-88842"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-92205",
        "url": "https://access.redhat.com/security/cve/CVE-2026-92205"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-124745",
        "url": "https://access.redhat.com/security/cve/CVE-2026-124745"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_81391.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-11-13T04:04:47+00:00",
      "generator": {
        "date": "2026-11-13T04:04:47+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.6"
        }
      },
      "id": "RHSA-2026:81391",
      "initial_release_date": "2026-10-12T17:14:28+00:00",
      "revision_history": [
        {
          "date": "2026-10-12T17:14:28+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-11T19:11:21+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-13T04:04:47+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "busybox-1:1.37.0-9.4.hum1@aarch64",
                "product": {
                  "name": "busybox-1:1.37.0-9.4.hum1@aarch64",
                  "product_id": "busybox-1:1.37.0-9.4.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox@1.37.0-9.4.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
                "product": {
                  "name": "busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
                  "product_id": "busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox-petitboot@1.37.0-9.4.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "busybox-shared-1:1.37.0-9.4.hum1@aarch64",
                "product": {
                  "name": "busybox-shared-1:1.37.0-9.4.hum1@aarch64",
                  "product_id": "busybox-shared-1:1.37.0-9.4.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox-shared@1.37.0-9.4.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "busybox-1:1.37.0-9.4.hum1@s390x",
                "product": {
                  "name": "busybox-1:1.37.0-9.4.hum1@s390x",
                  "product_id": "busybox-1:1.37.0-9.4.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox@1.37.0-9.4.hum1?arch=s390x\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
                "product": {
                  "name": "busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
                  "product_id": "busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox-petitboot@1.37.0-9.4.hum1?arch=s390x\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "busybox-shared-1:1.37.0-9.4.hum1@s390x",
                "product": {
                  "name": "busybox-shared-1:1.37.0-9.4.hum1@s390x",
                  "product_id": "busybox-shared-1:1.37.0-9.4.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox-shared@1.37.0-9.4.hum1?arch=s390x\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "busybox-1:1.37.0-9.4.hum1@src",
                "product": {
                  "name": "busybox-1:1.37.0-9.4.hum1@src",
                  "product_id": "busybox-1:1.37.0-9.4.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox@1.37.0-9.4.hum1?arch=src\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "busybox-1:1.37.0-9.4.hum1@x86_64",
                "product": {
                  "name": "busybox-1:1.37.0-9.4.hum1@x86_64",
                  "product_id": "busybox-1:1.37.0-9.4.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox@1.37.0-9.4.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
                "product": {
                  "name": "busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
                  "product_id": "busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox-petitboot@1.37.0-9.4.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "busybox-shared-1:1.37.0-9.4.hum1@x86_64",
                "product": {
                  "name": "busybox-shared-1:1.37.0-9.4.hum1@x86_64",
                  "product_id": "busybox-shared-1:1.37.0-9.4.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox-shared@1.37.0-9.4.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-1:1.37.0-9.4.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64"
        },
        "product_reference": "busybox-1:1.37.0-9.4.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-1:1.37.0-9.4.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x"
        },
        "product_reference": "busybox-1:1.37.0-9.4.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-1:1.37.0-9.4.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src"
        },
        "product_reference": "busybox-1:1.37.0-9.4.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-1:1.37.0-9.4.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64"
        },
        "product_reference": "busybox-1:1.37.0-9.4.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-petitboot-1:1.37.0-9.4.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64"
        },
        "product_reference": "busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-petitboot-1:1.37.0-9.4.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x"
        },
        "product_reference": "busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-petitboot-1:1.37.0-9.4.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64"
        },
        "product_reference": "busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-shared-1:1.37.0-9.4.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64"
        },
        "product_reference": "busybox-shared-1:1.37.0-9.4.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-shared-1:1.37.0-9.4.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x"
        },
        "product_reference": "busybox-shared-1:1.37.0-9.4.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-shared-1:1.37.0-9.4.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
        },
        "product_reference": "busybox-shared-1:1.37.0-9.4.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Shubham Raj"
          ],
          "organization": "Causal Security"
        }
      ],
      "cve": "CVE-2026-88842",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-07T07:10:06+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531355"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Low because the demonstrated impact is limited corruption of the dpkg status file (one stanza dropped) when busybox dpkg removes two packages in one invocation. It is a local issue and requires the victim to run the applet.\n\nFedora ships the dpkg applet in the busybox package (busybox dpkg), so the previous \u0027no deployment on Fedora/RHEL\u0027 Base 0.0 justification was incorrect. Red Hat Hardened Images (Hummingbird) also ship busybox and remain affected. RHEL 8, 9, and 10 do not ship busybox in the product compose; that absence belongs in product affectedness, not in a 0.0 base score. Finding 7 (CVE-2026-88835) is in the same file and remains 6.1 because that path is a reliable crash.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
          "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
          "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
          "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
          "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
          "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
          "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-88842"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531355",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531355"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-88842",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-88842"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88842",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88842"
        }
      ],
      "release_date": "2026-10-14T08:45:24.684000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T17:14:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81391"
        },
        {
          "category": "workaround",
          "details": "Do not use BusyBox dpkg for package management on systems where package integrity is critical. Remove packages one at a time if BusyBox dpkg must be used. Upstream should reset field_start at the beginning of each stanza iteration in write_status_file().",
          "product_ids": [
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption"
    },
    {
      "cve": "CVE-2026-92205",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access"
      },
      "discovery_date": "2026-10-21T17:31:56.446731+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2558404"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BusyBox. An attacker could leverage this vulnerability to create arbitrary files in unintended locations with the permissions of the target user. This issue occurs because the archive handling component fails to properly validate user-supplied file paths, allowing directory traversal through symbolic links when a user is tricked into processing a malicious archive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "busybox: busybox: Arbitrary file creation via directory traversal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A directory traversal vulnerability exists in the libarchive component of BusyBox. If a user is tricked into processing a specially crafted archive, an attacker can leverage symbolic links to bypass path validation and create arbitrary files outside the intended extraction directory with the privileges of the executing user.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
          "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
          "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
          "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
          "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
          "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
          "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92205"
        },
        {
          "category": "external",
          "summary": "RHBZ#2558404",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558404"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92205",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92205"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92205",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92205"
        },
        {
          "category": "external",
          "summary": "https://www.zerodayinitiative.com/advisories/ZDI-26-705/",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-705/"
        }
      ],
      "release_date": "2026-10-21T17:17:22.583000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T17:14:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81391"
        },
        {
          "category": "workaround",
          "details": "Avoid extracting untrusted archives using BusyBox\u0027s built-in extraction utilities. If archive extraction is strictly necessary, utilize fully featured alternatives like GNU tar within a restricted privilege environment.",
          "product_ids": [
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "busybox: busybox: Arbitrary file creation via directory traversal"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "TAE3"
          ]
        }
      ],
      "cve": "CVE-2026-108119",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access"
      },
      "discovery_date": "2026-10-09T14:03:56.635000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548611"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in busybox. The tar applet\u0027s deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly \u0027..\u0027 combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it. If the archive is extracted with elevated privileges, this flaw can lead to privilege escalation or arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Moderate impact because successful exploitation requires an attacker to convince a user or automated process to extract an untrusted archive, combined with non-trivial filesystem or extraction directory reuse constraints. The risk is further confined to scenarios where the BusyBox implementation of tar processes malicious archives with elevated privileges.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
          "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
          "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
          "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
          "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
          "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
          "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-108119"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548611",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548611"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-108119",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-108119"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-108119",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108119"
        }
      ],
      "release_date": "2026-10-09T15:31:42.723000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T17:14:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81391"
        },
        {
          "category": "workaround",
          "details": "Avoid extracting tar archives from untrusted sources using busybox, especially with elevated privileges or into a directory that will be reused for a subsequent extraction. If untrusted archives must be processed, extract into a freshly created, isolated directory with minimal privileges on a single filesystem boundary and discard it (including any links left on disk) after each extraction.",
          "product_ids": [
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Duc Anh Luu"
          ]
        }
      ],
      "cve": "CVE-2026-124745",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access"
      },
      "discovery_date": "2026-10-25T13:40:37+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571637"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate severity because exploitation requires a user or automated process to extract a specially crafted archive, and achieving unauthorized file modification typically requires subsequent extraction operations. In Red Hat environments, GNU tar is standard, and BusyBox is primarily utilized in constrained footprints like initramfs or recovery images rather than general-purpose extraction workflows. Consequently, exposure across common deployment scenarios is minimal.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
          "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
          "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
          "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
          "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
          "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
          "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
          "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-124745"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571637",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571637"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-124745",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-124745"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-124745",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124745"
        }
      ],
      "release_date": "2026-11-11T09:15:15+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T17:14:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81391"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@src",
            "Red Hat Hardened Images:busybox-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-petitboot-1:1.37.0-9.4.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@s390x",
            "Red Hat Hardened Images:busybox-shared-1:1.37.0-9.4.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory"
    }
  ]
}

CVE-2026-108119 (GCVE-0-2026-108119)

Vulnerability from cvelistv5 – Published: 2026-10-09 16:45 – Updated: 2026-11-05 15:56

Title

Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix

Summary

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 16:59 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1211 records in the last 180 days details

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:81391	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-108119	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2548611	issue-trackingx_refsource_REDHAT

Impacted products

2 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 1.37.0-9.4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:rhel_els:6

Date Public

2026-10-09 15:31

Credits

Red Hat would like to thank TAE3 for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108119",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T16:59:08.220810Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T16:59:20.957Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "busybox-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.37.0-9.4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "affected",
          "packageName": "busybox",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank TAE3 for reporting this issue."
        }
      ],
      "datePublic": "2026-10-09T15:31:42.723Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in busybox. The tar applet\u0027s deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly \u0027..\u0027 combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it. If the archive is extracted with elevated privileges, this flaw can lead to privilege escalation or arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T15:56:00.857Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:81391",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:81391"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-108119"
        },
        {
          "name": "RHBZ#2548611",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548611"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-09T14:03:56.635Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-09T15:31:42.723Z",
          "value": "Made public."
        }
      ],
      "title": "Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix",
      "workarounds": [
        {
          "lang": "en",
          "value": "Avoid extracting tar archives from untrusted sources using busybox, especially with elevated privileges or into a directory that will be reused for a subsequent extraction. If untrusted archives must be processed, extract into a freshly created, isolated directory with minimal privileges on a single filesystem boundary and discard it (including any links left on disk) after each extraction."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-108119",
    "datePublished": "2026-10-09T16:45:59.735Z",
    "dateReserved": "2026-10-09T14:09:13.658Z",
    "dateUpdated": "2026-11-05T15:56:00.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124745 (GCVE-0-2026-124745)

Vulnerability from cvelistv5 – Published: 2026-11-11 12:29 – Updated: 2026-11-13 04:05

Title

Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory

Summary

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-12 19:35 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1211 records in the last 180 days details

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:81391	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-124745	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2571637	issue-trackingx_refsource_REDHAT

Impacted products

2 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 1.37.0-9.4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:rhel_els:6

Date Public

2026-11-11 09:15

Credits

Red Hat would like to thank Duc Anh Luu for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-124745",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T19:35:06.918826Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T19:35:17.039Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "busybox-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.37.0-9.4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "busybox",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Duc Anh Luu for reporting this issue."
        }
      ],
      "datePublic": "2026-11-11T09:15:15.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T04:05:21.468Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:81391",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:81391"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-124745"
        },
        {
          "name": "RHBZ#2571637",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571637"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-25T13:40:37.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-11-11T09:15:15.000Z",
          "value": "Made public."
        }
      ],
      "title": "Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-124745",
    "datePublished": "2026-11-11T12:29:18.382Z",
    "dateReserved": "2026-11-09T11:36:29.479Z",
    "dateUpdated": "2026-11-13T04:05:21.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-88842 (GCVE-0-2026-88842)

Vulnerability from cvelistv5 – Published: 2026-10-14 10:02 – Updated: 2026-10-15 19:33

Title

Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption

Summary

Severity

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 10:52 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1211 records in the last 180 days details

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:81391	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-88842	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2531355	issue-trackingx_refsource_REDHAT

Impacted products

1 product

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 1.37.0-9.4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1

Date Public

2026-10-14 08:45

Credits

Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-88842",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T10:52:03.773503Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T10:52:14.893Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "busybox-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.37.0-9.4.hum1",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue."
        }
      ],
      "datePublic": "2026-10-14T08:45:24.684Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T19:33:22.460Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:81391",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:81391"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-88842"
        },
        {
          "name": "RHBZ#2531355",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531355"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-07T07:10:06.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-14T08:45:24.684Z",
          "value": "Made public."
        }
      ],
      "title": "Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption",
      "workarounds": [
        {
          "lang": "en",
          "value": "Do not use BusyBox dpkg for package management on systems where package integrity is critical. Remove packages one at a time if BusyBox dpkg must be used. Upstream should reset field_start at the beginning of each stanza iteration in write_status_file()."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-88842",
    "datePublished": "2026-10-14T10:02:05.270Z",
    "dateReserved": "2026-09-10T09:52:23.527Z",
    "dateUpdated": "2026-10-15T19:33:22.460Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92205 (GCVE-0-2026-92205)

Vulnerability from cvelistv5 – Published: 2026-10-21 17:17 – Updated: 2026-10-30 15:33

Title

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability

Summary

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user. Was ZDI-CAN-27556.

Severity

6.1 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-30 15:29 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 191 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
BusyBox	BusyBox	Affected: 1.37.0

Date Public

2026-09-16 15:10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92205",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T15:29:56.216820Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T15:33:17.542Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "BusyBox",
          "vendor": "BusyBox",
          "versions": [
            {
              "status": "affected",
              "version": "1.37.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:15:24.736Z",
      "datePublic": "2026-09-16T15:10:52.521Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user. Was ZDI-CAN-27556."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T17:17:22.583Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-705",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-705/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Ryota Shiga (GMO Flatt Security Inc.) with takumi-san.ai"
      },
      "title": "BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92205",
    "datePublished": "2026-10-21T17:17:22.583Z",
    "dateReserved": "2026-09-15T18:15:24.701Z",
    "dateUpdated": "2026-10-30T15:33:17.542Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:81391

CVE-2026-108119 (GCVE-0-2026-108119)

CVE-2026-124745 (GCVE-0-2026-124745)

CVE-2026-88842 (GCVE-0-2026-88842)

CVE-2026-92205 (GCVE-0-2026-92205)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour