A use‑after‑free flaw exists in the awk_sub() function of BusyBox v1.38.0. Supplying a specially crafted AWK script can trigger a memory‑access violation after the memory has been freed, causing the awk binary to crash and resulting in a denial of service for any process invoking it. The weakness is identified as CWE-416, which describes uncontrolled reuse of freed memory.

BusyBox v1.38.0, widely used on embedded devices and lightweight Linux distributions. No other vendors or products are listed.

The CVSS score of 4.9 places this issue in the moderate severity range, and an EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The CVE description does not specify an attack vector, but it is inferred that a local attacker with the ability to execute a crafted AWK script on the affected system can trigger the bug; no network interface or elevated privileges are mentioned. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited active exploitation.