Every CVE Search/ Get API key

CVE-2026-38754

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to...

5.1 MediumFix available

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

0.24%Up 0.1 points since Jul 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.1

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Record
CVE-2026-38754
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125, CWE-122
Updated
2026-11-02
EUVDEUVD-2026-44850 7.5

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Record
EUVD-2026-44850
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-jj7c-h3wm-vjfw 7.5

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to...

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Record
GHSA-jj7c-h3wm-vjfw
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-122, CWE-125
Updated
2026-11-02
NVD 5.1

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Record
CVE-2026-38754
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125, CWE-122
Updated
2026-11-02
OSVBELL-CVE-2026-38754 5.1
Record
BELL-CVE-2026-38754
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2026-38754 5.1

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Record
DEBIAN-CVE-2026-38754
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
Show 11 moreShow less
OSVOESA-2026-3312 5.1

busybox security update

The Swiss Army Knife of Embedded Linux

Security Fix(es):

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.(CVE-2026-38752)

A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.(CVE-2026-38753)

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.(CVE-2026-38754)

A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.(CVE-2026-38755)

Record
OESA-2026-3312
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVRHSA-2026:41130 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:41130
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-38754 7.5

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Record
UBUNTU-CVE-2026-38754
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVAZL-92484 No score

CVE-2026-38754 affecting package busybox for versions less than 1.36.1-26

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Record
AZL-92484
Updated
2026-11-05
OSVCLSA-2026-1787062482 No score

Fix CVE(s): CVE-2026-38753, CVE-2026-38754

  • SECURITY UPDATE: use-after-free in the awk sub()/gsub()/gensub() replacement string
    • debian/patches/CVE-2026-38753.patch: awk: copy the replacement string before evaluating the regex argument in awk_sub()
    • CVE-2026-38753
  • SECURITY UPDATE: out-of-bounds read in the ash IFS splitting code
    • debian/patches/CVE-2026-38754.patch: ash: release stale IFS region state when an expansion error is caught in redirectsafe()
    • CVE-2026-38754
Record
CLSA-2026-1787062482
Updated
2026-11-02
OSVopenSUSE-SU-2026:11605-1 No score

busybox-1.38.0-2.1 on GA media

These are all security issues fixed in the busybox-1.38.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11605-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22040-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42366: heap-buffer-overflow in the next_token function (bsc#1217586).
  • CVE-2026-38752: Denial of Service via crafted AWK script (bsc#1271544).
  • CVE-2026-38753: use-after-free in awk_sub() (bsc#1271545).
  • CVE-2026-38754: heap overflow in ifsbreakup() (bsc#1271547).
  • CVE-2026-38755: heap overflow in evalcommand() (bsc#1271548).
Record
openSUSE-SU-2026:22040-1
Updated
2026-11-02
OSVSUSE-SU-2026:23446-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42366: heap buffer overflow in the next_token function of editors/awk.c (bsc#1217586).
  • CVE-2026-38752: stack buffer overflow in the evaluate() function of editors/awk.c (bsc#1271544).
  • CVE-2026-38753: use-after-free in the awk_sub() function of editors/awk.c (bsc#1271545).
  • CVE-2026-38754: heap buffer overflow in ifsbreakup() function of shell/ash.c (bsc#1271547).
  • CVE-2026-38755: heap buffer overflow in evalcommand() function of shell/ash.c (bsc#1271548).
Record
SUSE-SU-2026:23446-1
Updated
2026-11-02
OSVSUSE-SU-2026:24154-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42366: heap-buffer-overflow in the next_token function (bsc#1217586).
  • CVE-2026-38752: Denial of Service via crafted AWK script (bsc#1271544).
  • CVE-2026-38753: use-after-free in awk_sub() (bsc#1271545).
  • CVE-2026-38754: heap overflow in ifsbreakup() (bsc#1271547).
  • CVE-2026-38755: heap overflow in evalcommand() (bsc#1271548).
Record
SUSE-SU-2026:24154-1
Updated
2026-11-02
OSVSUSE-SU-2026:3900-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42366: heap buffer overflow in the next_token function of editors/awk.c (bsc#1217586).
  • CVE-2026-38752: stack buffer overflow in the evaluate() function of editors/awk.c (bsc#1271544).
  • CVE-2026-38753: use-after-free in the awk_sub() function of editors/awk.c (bsc#1271545).
  • CVE-2026-38754: heap buffer overflow in ifsbreakup() function of shell/ash.c (bsc#1271547).
  • CVE-2026-38755: heap buffer overflow in evalcommand() function of shell/ash.c (bsc#1271548).
Record
SUSE-SU-2026:3900-1
Updated
2026-11-02
OSVSUSE-SU-2026:3933-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42366: heap buffer overflow in the next_token function of editors/awk.c (bsc#1217586).
  • CVE-2026-38752: stack buffer overflow in the evaluate() function of editors/awk.c (bsc#1271544).
  • CVE-2026-38753: use-after-free in the awk_sub() function of editors/awk.c (bsc#1271545).
  • CVE-2026-38754: heap buffer overflow in ifsbreakup() function of shell/ash.c (bsc#1271547).
  • CVE-2026-38755: heap buffer overflow in evalcommand() function of shell/ash.c (bsc#1271548).
Record
SUSE-SU-2026:3933-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
busybox
Azure Linux:3
 before 1.36.1-26
1.36.1-26
busybox
Alpaquita:23
 1.35.0-r29 up to 1.35.0-r41
1.35.0-r41
busybox
Alpaquita:25
 1.37.0-r20 up to 1.37.0-r28
1.37.0-r28
busybox
Alpaquita:stream
 1.36.1-r1 up to 1.38.0-r1
1.38.0-r1
busybox
BellSoft Hardened Containers:23
 1.35.0-r29 up to 1.35.0-r41
1.35.0-r41
busybox
BellSoft Hardened Containers:25
 1.37.0-r20 up to 1.37.0-r28
1.37.0-r28
busybox
BellSoft Hardened Containers:stream
 1.36.1-r1 up to 1.38.0-r1
1.38.0-r1
busybox
TuxCare:Debian:10
From an advisory covering 2 CVEs
 before 1:1.30.1-4+tuxcare.els4
1:1.30.1-4+tuxcare.els4
busybox-static
TuxCare:Debian:10
From an advisory covering 2 CVEs
 before 1:1.30.1-4+tuxcare.els4
1:1.30.1-4+tuxcare.els4
busybox-syslogd
TuxCare:Debian:10
From an advisory covering 2 CVEs
 before 1:1.30.1-4+tuxcare.els4
1:1.30.1-4+tuxcare.els4
Show 28 moreShow less
Affected packages
PackageAffectedFixed
udhcpc
TuxCare:Debian:10
From an advisory covering 2 CVEs
 before 1:1.30.1-4+tuxcare.els4
1:1.30.1-4+tuxcare.els4
udhcpd
TuxCare:Debian:10
From an advisory covering 2 CVEs
 before 1:1.30.1-4+tuxcare.els4
1:1.30.1-4+tuxcare.els4
busybox
Debian:12
 All versions, plus listed versions
1:1.35.0-41:1.35.0-4+deb12u11:1.36.0-1~exp11:1.36.1-11:1.36.1-2
Show 23 moreShow less
1:1.36.1-31:1.36.1-3.11:1.36.1-41:1.36.1-51:1.36.1-61:1.36.1-6~exp.11:1.36.1-71:1.36.1-81:1.36.1-91:1.37.0-11:1.37.0-101:1.37.0-10.11:1.37.0-21:1.37.0-31:1.37.0-41:1.37.0-51:1.37.0-61:1.37.0-71:1.37.0-81:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3
 None known
busybox
Debian:13
 All versions, plus listed versions
1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-8
Show 4 moreShow less
1:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3
 None known
busybox
Debian:14
 before 1:1.38.0-3, plus listed versions
1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-81:1.37.0-91:1.38.0-11:1.38.0-2
1:1.38.0-3
busybox
openEuler:24.03-LTS-SP1
From an advisory covering 4 CVEs
 before 1.36.1-21.oe2403sp1
1.36.1-21.oe2403sp1
busybox
openEuler:24.03-LTS-SP3
From an advisory covering 4 CVEs
 before 1.36.1-21.oe2403sp3
1.36.1-21.oe2403sp3
busybox
openEuler:24.03-LTS-SP4
From an advisory covering 4 CVEs
 before 1.36.1-21.oe2403sp4
1.36.1-21.oe2403sp4
busybox
openEuler:20.03-LTS-SP4
From an advisory covering 4 CVEs
 before 1.31.1-35.oe2003sp4
1.31.1-35.oe2003sp4
busybox
openEuler:22.03-LTS-SP4
From an advisory covering 4 CVEs
 before 1.34.1-34.oe2203sp4
1.34.1-34.oe2203sp4
busybox
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.37.0-8.1.hum1
0:1.37.0-8.1.hum1
busybox-petitboot
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.37.0-8.1.hum1
0:1.37.0-8.1.hum1
busybox-shared
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.37.0-8.1.hum1
0:1.37.0-8.1.hum1
busybox
SUSE:Linux Micro 6.0
From an advisory covering 5 CVEs
 before 1.36.1-5.1
1.36.1-5.1
busybox
SUSE:Linux Enterprise Server 16.0
From an advisory covering 5 CVEs
 before 1.37.0-160000.7.1
1.37.0-160000.7.1
busybox
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 5 CVEs
 before 1.37.0-160000.7.1
1.37.0-160000.7.1
busybox
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 5 CVEs
 before 1.35.0-10.9.1
1.35.0-10.9.1
busybox
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 5 CVEs
 before 1.37.0-150700.18.21.1
1.37.0-150700.18.21.1
busybox
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:1.20.0-8.1ubuntu11:1.20.0-9ubuntu11:1.20.0-9ubuntu21:1.21.0-1ubuntu11:1.21.0-1ubuntu1.41:1.21.0-1ubuntu1.4+esm1
 None known
busybox
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1:1.22.0-15ubuntu11:1.22.0-15ubuntu1.41:1.22.0-15ubuntu1.4+esm11:1.22.0-15ubuntu1.4+esm2
 None known
busybox
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:1.22.0-19ubuntu21:1.27.2-1ubuntu31:1.27.2-1ubuntu41:1.27.2-2ubuntu21:1.27.2-2ubuntu3
Show 5 moreShow less
1:1.27.2-2ubuntu3.11:1.27.2-2ubuntu3.21:1.27.2-2ubuntu3.31:1.27.2-2ubuntu3.41:1.27.2-2ubuntu3.4+esm1
 None known
busybox
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:1.30.1-4ubuntu41:1.30.1-4ubuntu51:1.30.1-4ubuntu61:1.30.1-4ubuntu6.11:1.30.1-4ubuntu6.21:1.30.1-4ubuntu6.31:1.30.1-4ubuntu6.41:1.30.1-4ubuntu6.5
 None known
busybox
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:1.30.1-6ubuntu31:1.30.1-7ubuntu11:1.30.1-7ubuntu21:1.30.1-7ubuntu31:1.30.1-7ubuntu3.1
 None known
busybox
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:1.36.1-3ubuntu11:1.36.1-6ubuntu11:1.36.1-6ubuntu31:1.36.1-6ubuntu3.1
 None known
busybox
Ubuntu:26.10
 All versions, plus listed versions
1:1.37.0-7ubuntu11:1.37.0-10.1ubuntu21:1.37.0-10.1ubuntu31:1.38.0-3ubuntu11:1.38.0-3ubuntu31:1.38.0-3ubuntu4
 None known
busybox
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:1.37.0-4ubuntu11:1.37.0-7ubuntu1
 None known
busybox
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 1.38.0-2.1
1.38.0-2.1
busybox
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 1.37.0-160000.7.1
1.37.0-160000.7.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-38754 is a medium vulnerability (CVSS 5.1) in Busybox, published July 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. Fixed in busybox 1.36.1-26.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open