PatchTheCVEbusybox vulnerabilities
Recent CVEs affecting busybox products. 4 tracked.
busybox has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2026-07-15. Highest priority: CVE-2026-38754 (score 21/100).
- CVE-2026-38754 MEDIUM 5.1 DOWNGRADE A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Deni
- CVE-2026-38755 LOW 2.9 DOWNGRADE A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Den
- CVE-2026-38753 MEDIUM 4.9 DOWNGRADE A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Deni
- CVE-2026-38752 LOW 2.9 DOWNGRADE A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause
FAQ
How do I fix busybox vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is busybox being exploited right now?
None of the tracked busybox CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which busybox CVE should I patch first?
CVE-2026-38754 currently ranks highest (21/100): A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Deni.