CVE-2026-88835
Received Received - Intake

Heap Out-of-Bounds Read in BusyBox dpkg

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-88835
EUVD
EUVD-2026-85510

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
busybox dpkg *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves BusyBox's dpkg applet where the read_package_field() function incorrectly processes malformed .deb packages. It steps past a NUL terminator, causing an out-of-bounds heap read. This can lead to crashes or potential memory leaks in the dpkg applet.

Detection Guidance

Detecting this vulnerability requires checking if your system uses BusyBox's dpkg applet and processing malformed .deb packages. Monitor for crashes or heap memory leaks when handling .deb files. Use commands like 'busybox dpkg --version' to check for BusyBox dpkg usage. Test with intentionally malformed .deb files in a controlled environment to observe behavior.

Impact Analysis

The vulnerability can cause the dpkg applet to crash or leak adjacent heap memory when processing malicious .deb packages. This may result in denial-of-service conditions or unauthorized information disclosure. Systems relying on BusyBox's dpkg are particularly at risk.

Mitigation Strategies

Avoid using BusyBox's dpkg applet for untrusted .deb packages. Use the full dpkg implementation instead. If possible, upgrade to a patched version of BusyBox or disable the dpkg applet in BusyBox. Monitor for updates from your Linux distribution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88835. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart