Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
BusyBox can be tricked into crashing or being hijacked
published 1 month ago
Summary
The BusyBox component used in Azure can be forced to read specially crafted file data that overruns its memory. This could let an attacker cause the program to stop working or potentially take control. Update BusyBox to the latest version or apply the vendor’s security patch to fix the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | busybox | <= 1.36.1-27 |
Original advisory text
CVE-2026-88832 affecting package busybox 1.36.1-27
BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.
References
Timeline
Published23 Sep 2026
Updated1 Oct 2026
First seen1 Oct 2026
Sources
AZL-105128 · OSV
Track software like this
Free during beta