The flaw resides in BusyBox’s dpkg‑deb extraction logic, where the ar archive handler flushes deferred symlinks after each member instead of once at the end. A crafted .deb archive that contains two data.tar members can exploit this ordering. The first member introduces a symlink to an absolute path such as '/', which is deferred as unsafe but is flushed immediately during the first member’s extraction. The second member then declares a regular file whose path follows the now‑live symlink, creating a file outside the intended extraction directory. The vulnerability enables an attacker to write arbitrary files to arbitrary locations. Based on the description, this could lead to privilege escalation or other destructive actions.

The issue affects the BusyBox dpkg‑deb component used in Red Hat Hardened Images, specifically the Red Hat Hummingbird image 1. The vulnerability applies to any instance of BusyBox dpkg‑deb that processes .deb archives, so any system or container image that relies on BusyBox for package extraction is potentially impacted.

The vulnerability has a CVSS score of 7.8, indicating high impact. Its EPSS score is below 1 %, suggesting a low current exploitation probability, and it is not listed in the CISA KEV catalog. Attackers can exploit the flaw by locally executing BusyBox dpkg‑deb against a specially crafted .deb file. The attack requirement is minimal – any user with permission to run the extraction can trigger the path traversal and write arbitrary files, making the threat scale with write‑access to the system.