Every CVE Search/ Get API key

CVE-2026-88830

Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow

7.5 High

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.35%Unchanged since Sep 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

Record
CVE-2026-88830
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-131
Updated
2026-11-02
EUVDEUVD-2026-85425 7.5

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

Record
EUVD-2026-85425
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mv57-fr8w-22gj 7.5

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre...

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

Record
GHSA-mv57-fr8w-22gj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-131
Updated
2026-11-02
NVD 7.5

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

Record
CVE-2026-88830
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-131
Updated
2026-11-02
OSVDEBIAN-CVE-2026-88830 7.5

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

Record
DEBIAN-CVE-2026-88830
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-88830 7.5

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

Record
UBUNTU-CVE-2026-88830
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVopenSUSE-SU-2026:11954-1 No score

busybox-1.38.0-3.1 on GA media

These are all security issues fixed in the busybox-1.38.0-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11954-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22067-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message (bsc#1282575).
  • CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
  • CVE-2026-88832: romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576).
  • CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages (bsc#1282551).
  • CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
  • CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
  • CVE-2026-88841: OOB read and silent memory corruption of the status file due to write_status_file() failing to reset the field_start cursor between package stanzas (bsc#1282653).
Record
openSUSE-SU-2026:22067-1
Updated
2026-11-02
OSVSUSE-SU-2026:24137-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message (bsc#1282575).
  • CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
  • CVE-2026-88832: romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576).
  • CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages (bsc#1282551).
  • CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
  • CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
  • CVE-2026-88841: OOB read and silent memory corruption of the status file due to write_status_file() failing to reset the field_start cursor between package stanzas (bsc#1282653).
Record
SUSE-SU-2026:24137-1
Updated
2026-11-02
OSVSUSE-SU-2026:24215-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message (bsc#1282575).
  • CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
  • CVE-2026-88832: romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576).
  • CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages (bsc#1282551).
  • CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
  • CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
  • CVE-2026-88841: OOB read and silent memory corruption of the status file due to write_status_file() failing to reset the field_start cursor between package stanzas (bsc#1282653).
Record
SUSE-SU-2026:24215-1
Updated
2026-11-02
OSVSUSE-SU-2026:4760-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message (bsc#1282575).
  • CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
  • CVE-2026-88832: romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576).
  • CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages (bsc#1282551).
  • CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
  • CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
  • CVE-2026-88841: OOB read and silent memory corruption of the status file due to write_status_file() failing to reset the field_start cursor between package stanzas (bsc#1282653).
Record
SUSE-SU-2026:4760-1
Updated
2026-11-02
OSVSUSE-SU-2026:4773-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message (bsc#1282575).
  • CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
  • CVE-2026-88832: romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576).
  • CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages (bsc#1282551).
  • CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
  • CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
  • CVE-2026-88841: OOB read and silent memory corruption of the status file due to write_status_file() failing to reset the field_start cursor between package stanzas (bsc#1282653).
Record
SUSE-SU-2026:4773-1
Updated
2026-11-02
OSVSUSE-SU-2026:4798-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message (bsc#1282575).
  • CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
  • CVE-2026-88832: romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576).
  • CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages (bsc#1282551).
  • CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
  • CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
  • CVE-2026-88841: OOB read and silent memory corruption of the status file due to write_status_file() failing to reset the field_start cursor between package stanzas (bsc#1282653).
Record
SUSE-SU-2026:4798-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
busybox
Debian:12
 All versions, plus listed versions
1:1.35.0-41:1.35.0-4+deb12u11:1.36.0-1~exp11:1.36.1-11:1.36.1-2
Show 23 moreShow less
1:1.36.1-31:1.36.1-3.11:1.36.1-41:1.36.1-51:1.36.1-61:1.36.1-6~exp.11:1.36.1-71:1.36.1-81:1.36.1-91:1.37.0-11:1.37.0-101:1.37.0-10.11:1.37.0-21:1.37.0-31:1.37.0-41:1.37.0-51:1.37.0-61:1.37.0-71:1.37.0-81:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3
 None known
busybox
Debian:13
 All versions, plus listed versions
1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-8
Show 4 moreShow less
1:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3
 None known
busybox
Debian:14
 All versions, plus listed versions
1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-8
Show 4 moreShow less
1:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3
 None known
busybox
SUSE:Linux Micro 6.0
From an advisory covering 7 CVEs
 before 1.36.1-159998.1.1
1.36.1-159998.1.1
busybox
SUSE:Linux Enterprise Server 16.0
From an advisory covering 7 CVEs
 before 1.37.0-160000.8.1
1.37.0-160000.8.1
busybox
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 7 CVEs
 before 1.37.0-160000.8.1
1.37.0-160000.8.1
busybox
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
 before 1.37.0-150700.18.24.1
1.37.0-150700.18.24.1
busybox
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 7 CVEs
 before 1.35.0-10.12.1
1.35.0-10.12.1
busybox
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 7 CVEs
 before 1.35.0-10.12.1
1.35.0-10.12.1
busybox
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 7 CVEs
 before 1.35.0-150400.3.23.1
1.35.0-150400.3.23.1
Show 13 moreShow less
Affected packages
PackageAffectedFixed
busybox
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 7 CVEs
 before 1.35.0-150400.3.23.1
1.35.0-150400.3.23.1
busybox
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 7 CVEs
 before 1.35.0-150400.3.23.1
1.35.0-150400.3.23.1
busybox
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 7 CVEs
 before 1.35.0-150400.3.23.1
1.35.0-150400.3.23.1
busybox
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:1.20.0-8.1ubuntu11:1.20.0-9ubuntu11:1.20.0-9ubuntu21:1.21.0-1ubuntu11:1.21.0-1ubuntu1.41:1.21.0-1ubuntu1.4+esm1
 None known
busybox
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1:1.22.0-15ubuntu11:1.22.0-15ubuntu1.41:1.22.0-15ubuntu1.4+esm11:1.22.0-15ubuntu1.4+esm2
 None known
busybox
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:1.22.0-19ubuntu21:1.27.2-1ubuntu31:1.27.2-1ubuntu41:1.27.2-2ubuntu21:1.27.2-2ubuntu3
Show 5 moreShow less
1:1.27.2-2ubuntu3.11:1.27.2-2ubuntu3.21:1.27.2-2ubuntu3.31:1.27.2-2ubuntu3.41:1.27.2-2ubuntu3.4+esm1
 None known
busybox
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:1.30.1-4ubuntu41:1.30.1-4ubuntu51:1.30.1-4ubuntu61:1.30.1-4ubuntu6.11:1.30.1-4ubuntu6.21:1.30.1-4ubuntu6.31:1.30.1-4ubuntu6.41:1.30.1-4ubuntu6.5
 None known
busybox
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:1.30.1-6ubuntu31:1.30.1-7ubuntu11:1.30.1-7ubuntu21:1.30.1-7ubuntu31:1.30.1-7ubuntu3.1
 None known
busybox
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:1.36.1-3ubuntu11:1.36.1-6ubuntu11:1.36.1-6ubuntu31:1.36.1-6ubuntu3.1
 None known
busybox
Ubuntu:26.10
 All versions, plus listed versions
1:1.37.0-7ubuntu11:1.37.0-10.1ubuntu21:1.37.0-10.1ubuntu31:1.38.0-3ubuntu11:1.38.0-3ubuntu31:1.38.0-3ubuntu4
 None known
busybox
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:1.37.0-4ubuntu11:1.37.0-7ubuntu1
 None known
busybox
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 1.38.0-3.1
1.38.0-3.1
busybox
openSUSE:Leap 16.0
From an advisory covering 7 CVEs
 before 1.37.0-160000.8.1
1.37.0-160000.8.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-88830 is a high vulnerability (CVSS 7.5) in Red Hat Hardened Images, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. No source names a fixed version.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open