A flaw exists in BusyBox’s dpkg implementation where the write_status_file() function does not reset its field cursor between package stanzas. When two packages are removed in a single invocation and the first package’s stanza is larger than the second, the second package’s entry can be omitted from the status file, resulting in limited data corruption of that file.

Red Hat Hardened Images, specifically the BusyBox dpkg component embedded in the Hummingbird 1 image. No explicit version range is provided beyond the image designation. Systems that use BusyBox dpkg for critical package management are affected.

The CVSS score of 3.3 indicates the overall severity is low. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires a local user with sufficient privileges to invoke the BusyBox dpkg removal operation. The likely attack vector is local privileged access. This operation can lead to corruption of the dpkg status file, which may affect the accuracy of package inventory but does not inherently provide a direct way to elevate privileges or cause denial of service.