VulnSocial

CVE-2026-38755Disclosure(busybox / busybox)

LOWCVSS 2.9 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch busybox busybox systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

busybox CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-674CWE-122

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • busybox

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-07-16); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
busybox
Products
busybox

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-07-16: 1Mentions · 2026-07-20: 1Mentions · 2026-07-21: 1Patch / Workaround · 2026-07-20: 1Technical Details · 2026-07-16: 1Technical Details · 2026-07-20: 1Technical Details · 2026-07-21: 107-1607-2007-21
Signal classification3 categories
Disclosure
133.3%
Patch
133.3%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-161
Disclosure1
2026-07-201
Patch1
2026-07-211
General1
Full discourse3 posts
  • Windows Forum@windowsforum
    General

    💥 BusyBox powers half the embedded world, so a “tiny” ash heap overflow can mean a lot of very unhappy devices. No confirmed code execution—just another reminder that small software still needs big patching. https://windowsforum.com/threads/cve-2026-38755-busybox-ash-heap-overflow-can-crash-devices.439784/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #DenialOfService #EmbeddedSecurity #Busybox https://t.co/CmnirbkJMn

    Post summary

    The tweet points out a heap overflow in BusyBox's ash shell (CVE-2026-38755), notes that no code execution has been confirmed, and serves as a reminder that even small software requires patching.

    0000011
    1.3K followersView on X
  • VulniPulse@vulnipulse
    Patch

    ⚠️ Red Hat Enterprise Linux 6 alert: CVE-2026-38755 (CVSS 5.5) Local attackers could disrupt service or cause a denial of service. Apply the vendor-recommended mitigation. https://vulnipulse.com/advisories/linux-cve-2026-38755 #Linux #RedHatEnterpriseLinux6 #CyberSecurity #CVE

    Post summary

    The advisory highlights CVE-2026-38755 on Red Hat Enterprise Linux 6, providing impact details and directing users to apply vendor‑recommended mitigation.

    0000034
    6 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-38755 Heap Overflow in Busybox v1.38.0 evalcommand() Function Causes Denial of Service https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-38755

    Post summary

    The excerpt announces a new heap overflow vulnerability in Busybox v1.38.0 that leads to denial of service, but does not provide a PoC, exploit, or patch details.

    00000126
    4.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appbusyboxbusybox1.38.0--

Explore more

Back to dashboardbusybox CVEsbusybox vulnerabilities