BusyBox’s AWK implementation suffers from a stack overflow in the evaluate() function, 371fe9. The vulnerability arises from insufficient bounds checking of user input which can corrupt the call stack and cause the AWK interpreter to crash. This flaw is a classic CWE‑121 stack‑based buffer overflow and results in a loss of availability for any system that relies on the bundled AWK utility.

All releases of BusyBox that include the vulnerable evaluate() implementation prior to a corrective fix are affected. This includes embedded devices, routers, and lightweight servers that ship BusyBox built from source before the mitigation. No explicit version list is provided, so any BusyBox installation that predates a future patch may be impacted.

The CVSS score of 2.9 indicates a low severity impact for this stack‑overflow flaw, while the EPSS score of less than 1% indicates a very low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, which suggests no large‑scale attacks have been documented. Exploitation would entail supplying a malicious AWK script to a running interpreter; depending on system configuration this could be local or remote. Based on the description, the likely attack vector involves an attacker delivering a crafted AWK script to the vulnerable interpreter, which could be executed from a local user context or via a remote interface that accepts script input. An attacker could cause the AWK process to terminate, potentially disrupting services that depend on it.