Description
BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.
Published: 2026-09-23
Score: 6.7 Medium
EPSS: n/a
KEV: No
Impact: Heap pointer out-of-bounds write leading to potential memory corruption
Action: Patch Application
AI Analysis

Impact

BusyBox’s passwd/group parser contains an out‑of‑bounds write of heap pointers caused by a stale tokenize() endpoint after trimming. This memory corruption can potentially allow an attacker to execute arbitrary code, crash the system, or disrupt services. The flaw is classified as CWE‑787.

Affected Systems

The vulnerability affects Red Hat Hardened Images based on BusyBox Hummingbird 1. No specific version range is provided, so any installation of this image that includes the affected BusyBox package is considered vulnerable.

Risk and Exploitability

The CVSS score of 6.7 indicates a medium severity impact. The EPSS score is not available, and the CVE is not listed in CISA’s KEV catalog. Attackers would need the ability to modify /etc/passwd or /etc/group to trigger the parser bug, which typically requires privileged or local access. The provided workaround recommends restricting write access to those files to root and protecting them with mandatory access controls, which mitigates the risk until a formal fix is delivered.

Generated by OpenCVE AI on September 23, 2026 at 19:53 UTC.

Remediation

Vendor Workaround

Ensure /etc/group and /etc/passwd are writable only by root and protected by mandatory access controls. Monitor these files for unauthorized modifications. Upstream should fix tokenize() to recompute tokenize_end after trimming.

OpenCVE Recommended Actions

  • Apply the latest Red Hat Hardened Images update that includes the BusyBox fix
  • Ensure /etc/passwd and /etc/group are writable only by root and protected by mandatory access controls
  • Set up monitoring to alert on any modification to /etc/passwd or /etc/group

Generated by OpenCVE AI on September 23, 2026 at 19:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Description BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.
Title Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-787
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-23T19:44:12.718Z

Reserved: 2026-09-10T09:42:04.559Z

Link: CVE-2026-88839

cve-icon Vulnrichment

Updated: 2026-09-23T19:19:15.591Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-23T18:17:10.640

Modified: 2026-09-23T20:17:20.863

Link: CVE-2026-88839

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T20:00:09Z

Weaknesses