CVE-2026-88842

Awaiting Analysis Awaiting Analysis - Queue

dpkg Package Data Corruption in BusyBox

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: redhat-SADP

Description

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-88842

EUVD

EUVD-2026-100957

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Hardened Images *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is in BusyBox's dpkg applet where the write_status_file() function fails to reset a field cursor between package stanzas. When two packages are removed simultaneously and the first stanza is larger than the second, the second package's stanza may be dropped from the status file, causing data corruption.

Detection Guidance

Detection requires checking if BusyBox's dpkg applet is installed and examining the dpkg status file for missing package stanzas after removal operations. Inspect /var/lib/dpkg/status for truncated entries or compare package lists before and after removal commands.

Impact Analysis

The impact is limited to minor corruption of the dpkg status file where one package stanza may be dropped. It requires local access and execution by the victim. In rare cases, it could cause crashes when AddressSanitizer is enabled or potential heap information leakage.

Compliance Impact

This vulnerability causes limited data corruption in the dpkg status file, specifically dropping a package stanza when two packages are removed simultaneously under certain conditions. This could lead to integrity issues in package management but does not directly expose or leak sensitive data like personal or health information. Compliance impact is likely minimal unless the affected system relies on BusyBox dpkg for critical operations in regulated environments.

Mitigation Strategies

Avoid using BusyBox dpkg for package management. If unavoidable, remove packages individually instead of multiple in one command. Monitor /var/lib/dpkg/status for corruption after operations. Apply upstream patches if available.

Hi! I’m here to help you understand CVE-2026-88842. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70