CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CSIRTSSecurity advisory fusion

← All products & vendors

Busybox — security advisories

7 advisorieslatest 2026-07-24⚡ RSS feed

Tracked Busybox products:

⚡ Watch Busybox

Get an email when a new Busybox advisory drops — max one per day, one-click unsubscribe.

[UPDATE] [low] BusyBox: Multiple vulnerabilities

lowCVE-2024-58251 CVE-2025-46394cert-bund2026-07-24

[NEW] [UNPATCHED] [medium] BusyBox: Multiple vulnerabilities allow Denial of Service

mediumCVE-2026-38752 CVE-2026-38753 CVE-2026-38754 CVE-2026-38755cert-bund2026-07-21

[UPDATE] [medium] BusyBox: Vulnerability allows file manipulation

mediumCVE-2023-39810cert-bund2026-07-15

CVE-2026-38752: A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

lowCVSS 2.9CVE-2026-38752msrc2026-07-14

CVE-2026-38754: A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

highCVSS 7.5CVE-2026-38754msrc2026-07-14

CVE-2026-38755: A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

highCVSS 7.5CVE-2026-38755msrc2026-07-14

CVE-2026-38753: A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

mediumCVSS 4.9CVE-2026-38753msrc2026-07-14