CVE-2026-38753

Modified Modified - Updated After Analysis

Use-After-Free in Busybox AWK Script Processing

Publication date: 2026-07-15

Last updated on: 2026-07-20

Assigner: MITRE

Description

A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-20

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-38753

Affected Vendors & Products

Vendor	Product	Version / Range
busybox	busybox	1.38.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free flaw in the awk_sub() function of Busybox version 1.38.0. A use-after-free occurs when a program continues to use memory after it has been freed, which can lead to crashes or other unexpected behavior.

Detection Guidance

Detecting this vulnerability requires checking for BusyBox versions affected by the use-after-free in awk_sub(). Inspect BusyBox installations for version 1.38.0 or earlier. Use commands like 'busybox | head -1' to check the version. Monitor system logs for crashes or errors during AWK script execution.

Impact Analysis

This vulnerability can cause a Denial of Service (DoS) by crashing the Busybox application. If exploited, it may disrupt services relying on Busybox, such as embedded systems or lightweight environments.

Compliance Impact

This vulnerability is a use-after-free in Busybox's awk_sub() function, causing a Denial of Service (DoS) via crafted AWK scripts. It does not directly impact compliance with GDPR or HIPAA as it is a DoS issue rather than a data exposure or privacy violation.

Mitigation Strategies

Upgrade Busybox to a version later than v1.38.0 where the use-after-free in awk_sub() has been patched. Avoid using AWK scripts from untrusted sources until patched.

Hi! I’m here to help you understand CVE-2026-38753. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70