Description
A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.
Published: 2026-08-19
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

BusyBox up to version 1.30.1 contains a flaw in the Feature Wget Timeout handler within networking/wget.c. When the -T argument is manipulated, the code dereferences a null pointer, causing the process that invoked wget to crash. This can be leveraged to disrupt local services that rely on BusyBox's wget implementation.

Affected Systems

Any system that ships BusyBox up to version 1.30.1 and enables the FEATURE_WGET_TIMEOUT option is susceptible. The vulnerability is present in all compiled binaries that include the flagged code path, regardless of the overall BusyBox version beyond the stated maximum.

Risk and Exploitability

The CVSS score of 4.8 reflects a moderate severity with local access required to provide the malformed -T argument. No EPSS data is available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an attacker to have the ability to run wget on the vulnerable system, making the risk contingent on local user privileges or compromised credentials.

Generated by OpenCVE AI on August 19, 2026 at 06:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch commit 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff to BusyBox or upgrade to a later release that includes the fix
  • If an upgrade is not immediately possible, rebuild BusyBox with the FEATURE_WGET_TIMEOUT option disabled to remove the vulnerable code
  • Limit who can invoke wget with the -T option by adjusting file permissions or using sudo policies so only trusted users can run the binary

Generated by OpenCVE AI on August 19, 2026 at 06:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 03:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.
Title BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference
First Time appeared Busybox
Busybox busybox
Weaknesses CWE-404
CWE-476
CPEs cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*
Vendors & Products Busybox
Busybox busybox
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Busybox Busybox
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-19T02:45:08.531Z

Reserved: 2026-08-18T19:02:48.220Z

Link: CVE-2026-76014

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-19T03:16:53.247

Modified: 2026-08-19T03:16:53.247

Link: CVE-2026-76014

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T07:00:12Z

Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release

  • CWE-476

    NULL Pointer Dereference