Medium severity4.9NVD Advisory· Published Jul 15, 2026· Updated Jul 20, 2026

CVE-2026-38753

Description

A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

Affected products

Busybox/Busyboxinferred3 versions
=1.38.0+ 2 more
- (no CPE)range: =1.38.0
- cpe:2.3:a:busybox:busybox:1.38.0:*:*:*:*:*:*:*
- (no CPE)range: =1.38.0
osv-coords7 versions
pkg:apk/chainguard/busybox pkg:apk/chainguard/busybox-full pkg:apk/chainguard/busybox-static pkg:apk/wolfi/busybox pkg:apk/wolfi/busybox-full pkg:apk/wolfi/busybox-static pkg:rpm/opensuse/busybox&distro=openSUSE%20Tumbleweed
< 1.38.0-r0+ 6 more
- (no CPE)range: < 1.38.0-r0
- (no CPE)range: < 1.38.0-r0
- (no CPE)range: < 1.38.0-r0
- (no CPE)range: < 1.38.0-r0
- (no CPE)range: < 1.38.0-r0
- (no CPE)range: < 1.38.0-r0
- (no CPE)range: < 1.38.0-2.1

Patches

Vulnerability mechanics

References

lists.busybox.net/pipermail/busybox/2026-June/092352.htmlnvdMailing ListPatchVendor Advisory
busybox.netnvd

News mentions

No linked articles in our index yet.

cvss	0.319
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000