Every CVE Search/ Get API key

CVE-2026-38752

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows...

2.9 LowFix available

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.21%Unchanged since Jul 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.9

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

Record
CVE-2026-38752
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674, CWE-121
Updated
2026-11-02
EUVDEUVD-2026-44848 7.5

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

Record
EUVD-2026-44848
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-fj27-x67r-v4g5 7.5

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows...

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

Record
GHSA-fj27-x67r-v4g5
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-121, CWE-674
Updated
2026-11-02
NVD 2.9

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

Record
CVE-2026-38752
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674, CWE-121
Updated
2026-11-02
OSVBELL-CVE-2026-38752 2.9
Record
BELL-CVE-2026-38752
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2026-38752 2.9

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

Record
DEBIAN-CVE-2026-38752
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 10 moreShow less
OSVOESA-2026-3312 5.1

busybox security update

The Swiss Army Knife of Embedded Linux

Security Fix(es):

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.(CVE-2026-38752)

A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.(CVE-2026-38753)

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.(CVE-2026-38754)

A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.(CVE-2026-38755)

Record
OESA-2026-3312
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVRHSA-2026:42074 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:42074
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-38752 7.5

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

Record
UBUNTU-CVE-2026-38752
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-92835 No score

CVE-2026-38752 affecting package busybox for versions less than 1.36.1-26

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

Record
AZL-92835
Updated
2026-11-05
OSVopenSUSE-SU-2026:11605-1 No score

busybox-1.38.0-2.1 on GA media

These are all security issues fixed in the busybox-1.38.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11605-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22040-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42366: heap-buffer-overflow in the next_token function (bsc#1217586).
  • CVE-2026-38752: Denial of Service via crafted AWK script (bsc#1271544).
  • CVE-2026-38753: use-after-free in awk_sub() (bsc#1271545).
  • CVE-2026-38754: heap overflow in ifsbreakup() (bsc#1271547).
  • CVE-2026-38755: heap overflow in evalcommand() (bsc#1271548).
Record
openSUSE-SU-2026:22040-1
Updated
2026-11-02
OSVSUSE-SU-2026:23446-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42366: heap buffer overflow in the next_token function of editors/awk.c (bsc#1217586).
  • CVE-2026-38752: stack buffer overflow in the evaluate() function of editors/awk.c (bsc#1271544).
  • CVE-2026-38753: use-after-free in the awk_sub() function of editors/awk.c (bsc#1271545).
  • CVE-2026-38754: heap buffer overflow in ifsbreakup() function of shell/ash.c (bsc#1271547).
  • CVE-2026-38755: heap buffer overflow in evalcommand() function of shell/ash.c (bsc#1271548).
Record
SUSE-SU-2026:23446-1
Updated
2026-11-02
OSVSUSE-SU-2026:24154-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42366: heap-buffer-overflow in the next_token function (bsc#1217586).
  • CVE-2026-38752: Denial of Service via crafted AWK script (bsc#1271544).
  • CVE-2026-38753: use-after-free in awk_sub() (bsc#1271545).
  • CVE-2026-38754: heap overflow in ifsbreakup() (bsc#1271547).
  • CVE-2026-38755: heap overflow in evalcommand() (bsc#1271548).
Record
SUSE-SU-2026:24154-1
Updated
2026-11-02
OSVSUSE-SU-2026:3900-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42366: heap buffer overflow in the next_token function of editors/awk.c (bsc#1217586).
  • CVE-2026-38752: stack buffer overflow in the evaluate() function of editors/awk.c (bsc#1271544).
  • CVE-2026-38753: use-after-free in the awk_sub() function of editors/awk.c (bsc#1271545).
  • CVE-2026-38754: heap buffer overflow in ifsbreakup() function of shell/ash.c (bsc#1271547).
  • CVE-2026-38755: heap buffer overflow in evalcommand() function of shell/ash.c (bsc#1271548).
Record
SUSE-SU-2026:3900-1
Updated
2026-11-02
OSVSUSE-SU-2026:3933-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42366: heap buffer overflow in the next_token function of editors/awk.c (bsc#1217586).
  • CVE-2026-38752: stack buffer overflow in the evaluate() function of editors/awk.c (bsc#1271544).
  • CVE-2026-38753: use-after-free in the awk_sub() function of editors/awk.c (bsc#1271545).
  • CVE-2026-38754: heap buffer overflow in ifsbreakup() function of shell/ash.c (bsc#1271547).
  • CVE-2026-38755: heap buffer overflow in evalcommand() function of shell/ash.c (bsc#1271548).
Record
SUSE-SU-2026:3933-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
busybox
Azure Linux:3
 before 1.36.1-26
1.36.1-26
busybox
Alpaquita:23
 1.35.0-r29 up to 1.35.0-r41
1.35.0-r41
busybox
Alpaquita:25
 1.37.0-r20 up to 1.37.0-r28
1.37.0-r28
busybox
Alpaquita:stream
 1.36.1-r1 up to 1.38.0-r1
1.38.0-r1
busybox
BellSoft Hardened Containers:23
 1.35.0-r29 up to 1.35.0-r41
1.35.0-r41
busybox
BellSoft Hardened Containers:25
 1.37.0-r20 up to 1.37.0-r28
1.37.0-r28
busybox
BellSoft Hardened Containers:stream
 1.36.1-r1 up to 1.38.0-r1
1.38.0-r1
busybox
Debian:12
 All versions, plus listed versions
1:1.35.0-41:1.35.0-4+deb12u11:1.36.0-1~exp11:1.36.1-11:1.36.1-2
Show 23 moreShow less
1:1.36.1-31:1.36.1-3.11:1.36.1-41:1.36.1-51:1.36.1-61:1.36.1-6~exp.11:1.36.1-71:1.36.1-81:1.36.1-91:1.37.0-11:1.37.0-101:1.37.0-10.11:1.37.0-21:1.37.0-31:1.37.0-41:1.37.0-51:1.37.0-61:1.37.0-71:1.37.0-81:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3
 None known
busybox
Debian:13
 All versions, plus listed versions
1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-8
Show 4 moreShow less
1:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3
 None known
busybox
Debian:14
 before 1:1.38.0-3, plus listed versions
1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-81:1.37.0-91:1.38.0-11:1.38.0-2
1:1.38.0-3
Show 23 moreShow less
Affected packages
PackageAffectedFixed
busybox
openEuler:24.03-LTS-SP1
From an advisory covering 4 CVEs
 before 1.36.1-21.oe2403sp1
1.36.1-21.oe2403sp1
busybox
openEuler:24.03-LTS-SP3
From an advisory covering 4 CVEs
 before 1.36.1-21.oe2403sp3
1.36.1-21.oe2403sp3
busybox
openEuler:24.03-LTS-SP4
From an advisory covering 4 CVEs
 before 1.36.1-21.oe2403sp4
1.36.1-21.oe2403sp4
busybox
openEuler:20.03-LTS-SP4
From an advisory covering 4 CVEs
 before 1.31.1-35.oe2003sp4
1.31.1-35.oe2003sp4
busybox
openEuler:22.03-LTS-SP4
From an advisory covering 4 CVEs
 before 1.34.1-34.oe2203sp4
1.34.1-34.oe2203sp4
busybox
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.37.0-8.2.hum1
0:1.37.0-8.2.hum1
busybox-petitboot
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.37.0-8.2.hum1
0:1.37.0-8.2.hum1
busybox-shared
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.37.0-8.2.hum1
0:1.37.0-8.2.hum1
busybox
SUSE:Linux Micro 6.0
From an advisory covering 5 CVEs
 before 1.36.1-5.1
1.36.1-5.1
busybox
SUSE:Linux Enterprise Server 16.0
From an advisory covering 5 CVEs
 before 1.37.0-160000.7.1
1.37.0-160000.7.1
busybox
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 5 CVEs
 before 1.37.0-160000.7.1
1.37.0-160000.7.1
busybox
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 5 CVEs
 before 1.35.0-10.9.1
1.35.0-10.9.1
busybox
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 5 CVEs
 before 1.37.0-150700.18.21.1
1.37.0-150700.18.21.1
busybox
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:1.20.0-8.1ubuntu11:1.20.0-9ubuntu11:1.20.0-9ubuntu21:1.21.0-1ubuntu11:1.21.0-1ubuntu1.41:1.21.0-1ubuntu1.4+esm1
 None known
busybox
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1:1.22.0-15ubuntu11:1.22.0-15ubuntu1.41:1.22.0-15ubuntu1.4+esm11:1.22.0-15ubuntu1.4+esm2
 None known
busybox
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:1.22.0-19ubuntu21:1.27.2-1ubuntu31:1.27.2-1ubuntu41:1.27.2-2ubuntu21:1.27.2-2ubuntu3
Show 5 moreShow less
1:1.27.2-2ubuntu3.11:1.27.2-2ubuntu3.21:1.27.2-2ubuntu3.31:1.27.2-2ubuntu3.41:1.27.2-2ubuntu3.4+esm1
 None known
busybox
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:1.30.1-4ubuntu41:1.30.1-4ubuntu51:1.30.1-4ubuntu61:1.30.1-4ubuntu6.11:1.30.1-4ubuntu6.21:1.30.1-4ubuntu6.31:1.30.1-4ubuntu6.41:1.30.1-4ubuntu6.5
 None known
busybox
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:1.30.1-6ubuntu31:1.30.1-7ubuntu11:1.30.1-7ubuntu21:1.30.1-7ubuntu31:1.30.1-7ubuntu3.1
 None known
busybox
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:1.36.1-3ubuntu11:1.36.1-6ubuntu11:1.36.1-6ubuntu31:1.36.1-6ubuntu3.1
 None known
busybox
Ubuntu:26.10
 All versions, plus listed versions
1:1.37.0-7ubuntu11:1.37.0-10.1ubuntu21:1.37.0-10.1ubuntu31:1.38.0-3ubuntu11:1.38.0-3ubuntu31:1.38.0-3ubuntu4
 None known
busybox
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:1.37.0-4ubuntu11:1.37.0-7ubuntu1
 None known
busybox
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 1.38.0-2.1
1.38.0-2.1
busybox
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 1.37.0-160000.7.1
1.37.0-160000.7.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-38752 is a low vulnerability (CVSS 2.9) in Busybox, published July 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in busybox 1.36.1-26.

References

Show 31 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open