Description
A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
Published: 2026-07-15
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A heap buffer overrun occurs in the ifsbreakup() function of the BusyBox ash shell (v1.38.0). The vulnerability, an instance of both CWE-122 and CWE-125, allows an attacker to supply crafted input that overflows a heap buffer and terminates the shell process, resulting in a denial of service.

Affected Systems

BusyBox v1.38.0, the shell module ash.c, used in embedded systems and lightweight Linux distributions

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity, but the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The defect is not listed in CISA KEV. The likely attack vector is to feed malicious input to the ash shell, either via local execution or by injecting a crafted script, which then crashes the process and disrupts availability. The flaw involves both CWE-122 and CWE-125 weaknesses. No fixed public workaround is available; an update is the recommended.

Generated by OpenCVE AI on July 31, 2026 at 04:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update BusyBox to a version newer than 1.38.0 that contains the heap-overflow fix.
  • If an update is not immediately available, limit the use of the ash shell to trusted input only or disable script processing functions that invoke ifsbreakup().
  • Monitor system logs for repeated ash shell crashes and isolate affected processes until a patch can be applied.

Generated by OpenCVE AI on July 31, 2026 at 04:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 31 Jul 2026 04:45:00 +0000

Type Values Removed Values Added
Title Heap Overflow in BusyBox Ash Shell Causes Denial of Service

Wed, 29 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Title Heap Buffer Overflow in BusyBox ash Shell Leading to Denial of Service

Sat, 25 Jul 2026 08:15:00 +0000

Type Values Removed Values Added
Title Heap Buffer Overflow in BusyBox ash Shell Leading to Denial of Service

Wed, 22 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
References

Wed, 22 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
Title Heap Overflow in BusyBox ash Shell Causing Denial of Service

Mon, 20 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
References

Mon, 20 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
CPEs cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 5.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}

Fri, 17 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Title Heap Overflow in BusyBox ash Shell Causing Denial of Service

Thu, 16 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 16 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Busybox
Busybox busybox
Vendors & Products Busybox
Busybox busybox

Wed, 15 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Description A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
References

Subscriptions

Busybox Busybox
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-07-22T14:42:57.143Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-38754

cve-icon Vulnrichment

Updated: 2026-07-16T15:20:59.767Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T04:30:03Z

Weaknesses