CVE-2026-38755

LowCVSS 2.9

Published: 15/07/2026(UTC)Updated: 20/07/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

A heap overflow in the evalcommand() function (shell/ash.c) of BusyBox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Risk Assessment

An attacker can crash embedded systems or devices running BusyBox, leading to service disruption.

Recommendation

Upgrade BusyBox to a version newer than 1.38.0 where the vulnerability is fixed. If not possible, restrict shell access and sanitize input.

Original NVD description (English source)

A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.