VulnSocial

CVE-2026-38754Disclosure(busybox / busybox)

LOWCVSS 5.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

busybox CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-125CWE-122

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • busybox

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-16); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
busybox
Products
busybox

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-16: 1Mentions · 2026-07-21: 1Technical Details · 2026-07-16: 1Technical Details · 2026-07-21: 107-1607-21
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-161
Disclosure1
2026-07-211
General1
Full discourse2 posts
  • Windows Forum@windowsforum
    General

    ⚠️ BusyBox’s tiny ash shell has a big crash button: crafted input can trigger a heap overflow and DoS. The “invisible” layer of embedded systems still needs very visible patching. https://windowsforum.com/threads/cve-2026-38754-busybox-1-38-0-ash-heap-overflow-causes-dos.439774/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #EmbeddedLinux #SupplyChainSecurity #Cve202638754 #BusyboxAsh https://t.co/psS6m7r3eT

    Post summary

    The tweet highlights a heap overflow-based DoS vulnerability (CVE-2026-38754) in BusyBox ash shell, referencing a forum thread, but does not provide PoC, exploit details, active exploitation evidence, or patch information.

    0100018
    1.3K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-38754 Heap Overflow in Busybox v1.38.0 ifsbreakup() Function Denial of Service https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-38754

    Post summary

    The text announces CVE-2026-38754, detailing a heap overflow vulnerable in Busybox v1.38.0’s ifsbreakup() function that leads to a denial of service.

    00000121
    4.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appbusyboxbusybox1.38.0--

Explore more

Back to dashboardbusybox CVEsbusybox vulnerabilities