BusyBox's dpkg read_package_field function advances past the null terminator when parsing malformed .deb files, leading to an out-of-bounds heap read. This flaw allows an attacker to read memory that the process does not normally have access to, which could expose sensitive data or cause a crash. The weakness is CWE-125, a classic buffer overread vulnerability that can be abused for information disclosure or denial of service.

This issue affects BusyBox images delivered in Red Hat Hardened Images, specifically the Hummingbird release identified by the CPE cpe:/a:redhat:hummingbird:1. Systems that rely on the BusyBox dpkg applet to process Debian packages are at risk. No specific version numbers are provided beyond the product reference.

The CVSS score of 6.1 indicates medium severity, but the lack of an available EPSS score and absence from CISA KEV suggests limited current exploitation activity. The attack vector is inferred to be local or requires the ability to provide a crafted .deb package to the target, as the flaw is triggered during package parsing. If an attacker can supply such a package, they might read memory or cause a crash, but no elevation of privilege is implied by the current description.