{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-88835", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-10T09:42:04.559Z", "datePublished": "2026-09-23T17:45:27.703Z", "dateUpdated": "2026-09-23T17:45:27.703Z"}, "containers": {"cna": {"title": "Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Hardened Images", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "busybox", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:hummingbird:1"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-88835", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531349", "name": "RHBZ#2531349", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-23T16:35:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-125: Out-of-bounds Read", "workarounds": [{"lang": "en", "value": "Do not use the BusyBox dpkg applet to process untrusted .deb packages. Use the full dpkg implementation if Debian package handling is needed."}], "timeline": [{"lang": "en", "time": "2026-09-09T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-23T16:35:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-23T17:45:27.703Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "busybox", "product": "Red Hat Hardened Images", "vendor": "Red Hat"}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read."}], "id": "CVE-2026-88835", "lastModified": "2026-09-23T19:40:10.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "[email protected]", "type": "Primary"}]}, "published": "2026-09-23T18:17:10.350", "references": [{"source": "[email protected]", "url": "https://access.redhat.com/security/cve/CVE-2026-88835"}, {"source": "[email protected]", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531349"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "[email protected]", "type": "Primary"}]}

{"bugzilla": {"description": "busybox: busybox: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages", "id": "2531349", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531349"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read."], "mitigation": {"lang": "en:us", "value": "Do not use the BusyBox dpkg applet to process untrusted .deb packages. Use the full dpkg implementation if Debian package handling is needed."}, "name": "CVE-2026-88835", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "busybox", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-23T16:35:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-88835\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88835"], "statement": "This flaw allows a crafted .deb package to crash the BusyBox dpkg applet or potentially leak adjacent heap memory. Fedora uses RPM as its package management format, and the BusyBox dpkg applet has no practical deployment scenario on Fedora systems.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "product": "busybox", "vendor": "busybox"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "Red Hat Hardened Images", "source": "cna", "vendor": "Red Hat"}, "product": "hardened_images", "vendor": "redhat"}], "created": "2026-09-23T20:00:09.002170+00:00", "updated": "2026-09-24T09:10:32.544045+00:00", "vendors": ["busybox", "busybox$PRODUCT$busybox", "redhat", "redhat$PRODUCT$hardened_images"]}