CVE-2026-38755

Modified Modified - Updated After Analysis

Heap Overflow in BusyBox v1.38.0

Publication date: 2026-07-15

Last updated on: 2026-07-20

Assigner: MITRE

Description

A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-20

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-38755

EUVD

EUVD-2026-44851

Affected Vendors & Products

Vendor	Product	Version / Range
busybox	busybox	1.38.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is a heap overflow in the evalcommand() function within the shell/ash.c file of Busybox version 1.38.0. A heap overflow occurs when a program writes more data to a buffer than it can hold, corrupting adjacent memory. This can lead to crashes or other unexpected behavior.

Detection Guidance

This vulnerability involves a heap overflow in Busybox v1.38.0's evalcommand() function. Detection requires checking Busybox version and testing for crashes with crafted inputs. Use 'busybox | head -1' to check version. No direct commands are provided in the context to exploit or detect this issue.

Impact Analysis

This vulnerability can cause a Denial of Service (DoS) by crashing the Busybox application. If exploited, it may disrupt services relying on Busybox, leading to system instability or unavailability.

Compliance Impact

The provided CVE describes a heap overflow in Busybox v1.38.0 causing a DoS via crafted input. This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it is a technical flaw in a specific software component rather than a data protection or privacy issue.

Mitigation Strategies

Upgrade Busybox to a version later than v1.38.0 where the heap overflow in evalcommand() has been patched.

Hi! I’m here to help you understand CVE-2026-38755. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70