All vulnerabilities
CVE-2026-88842

Red Hat Hardened Images: Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption

Red Hat Red Hat Hardened ImagesOperating systems
Open in ThreatlineRecord JSON
CVSS
3.3Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published14 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

Text from CVE List

Affected versions 1

  • Red Hat Hardened Imagesunaffected: 1.37.0-9.4.hum1 and laterCVE List

References 3