A flaw in the BusyBox utility allows an attacker to craft a tar archive containing hardlink or symlink entries that are not validated during extraction. When such an archive is processed with elevated privileges, the archive can modify files outside the intended extraction directory, giving the attacker unauthorized access to critical system files. This behavior corresponds to CWE-73 and can lead to privilege escalation.

Systems that use BusyBox within Red Hat Enterprise Linux 6 or Red Hat Hardened Images are affected. No specific BusyBox version range is provided in the data, so all installations of BusyBox in these environments should be examined for the presence of the vulnerable extraction logic.

The vulnerability has a CVSS score of 7, indicating high severity, but the EPSS score is below 1 % and the issue is not listed in the CISA KEV catalog, suggesting a low current exploitation probability. The likely attack vector involves an attacker providing a malicious tar archive that is extracted by a process running with elevated privileges—either locally or via a chain of services that invoke BusyBox tar. If this scenario occurs, the attacker can modify privileged files and elevate privilege, though such conditions are relatively restricted. The risk is therefore high for affected systems that routinely extract untrusted archives with root privileges.