CVE-2026-76014
Received Received - Intake

Null Pointer Dereference in BusyBox via WGET Timeout

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulDB

Description
A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76014
EUVD
EUVD-2026-62225

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
busybox busybox to 1.30.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference in BusyBox's wget applet when the -T timeout option is used with FEATURE_WGET_TIMEOUT disabled. The issue occurs because the wget applet still exposes the -T option in its argument parser even when the feature is disabled, leading to a NULL pointer being written to when the parsed timeout value is assigned. This results in a segmentation fault, causing a local denial of service.

Detection Guidance
  • Check BusyBox version with command: busybox | head -n 1. If version is up to 1.30.1, system is vulnerable.
  • Test for vulnerability by running: busybox wget -T 0. If system crashes with segmentation fault, vulnerability is present.
  • Inspect wget applet behavior when FEATURE_WGET_TIMEOUT is disabled by testing various -T values like -T 1 or -T 10.
Impact Analysis

The vulnerability can cause a local denial of service by crashing the BusyBox wget process when the -T option is used. This may lead to application or system instability for users running affected versions of BusyBox. Privilege escalation, code execution, or information disclosure have not been confirmed.

Mitigation Strategies
  • Apply the patch from commit 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff to BusyBox source code.
  • Recompile BusyBox with the patch applied to ensure the -T option is properly handled or disabled when FEATURE_WGET_TIMEOUT is off.
  • Update BusyBox to a version that includes the fix if available from official repositories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76014. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart