A heap overflow occurs in the evalcommand() function of BusyBox’s shell (ash.c) when it processes a specially crafted input string. The overflow can corrupt heap data structures, causing the shell to crash and potentially require a restart of the host service that relies on it. The impact is a disruption of availability rather than a compromise of data or control.

BusyBox version 1.38.0 is vulnerable. The flaw resides in the evalcommand() implementation within the BusyBox shell. Systems using this exact release, without applying a later hotfix, are affected.

The CVSS score of 2.9 indicates low severity, while the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, so no known active exploits have been documented. The likely attack vector is local or remote access to the BusyBox shell where an adversary can supply a malicious command string to trigger the overflow, leading to a denial of service for users interacting with that service.