CVE-2026-76014
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability was found in BusyBox up to version 1.30.1 in the file networking/wget.c, in the FEATURE_WGET_TIMEOUT Handler component. Manipulation of the -T argument leads to a null pointer dereference. Local access is required. The exploit has been disclosed, and a patch is available (commit 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff).
Risk Assessment
A local attacker could cause the wget program to crash, potentially disrupting services or exploiting the vulnerability for further attacks.
Recommendation
Apply the available patch (commit 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff) or update BusyBox to a newer version.
Other vulnerabilities in BusyBox
See all- CVE-2026-88836Unknown
This CVE candidate has been rejected by Red Hat Product Security because it is not a security vulnerability. BusyBox internal TLS is intentionally minimal and documents in FEATURE_WGET_HTTPS that it does not verify peer identity or provide full TLS security; missing Finished verify_data checking is consistent with that documented design and does not cross a separate security boundary warranting a CVE.
- CVE-2024-58251Low
In netstat in BusyBox through 1.37.0, local users can launch a network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
- CVE-2023-42365Medium
A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.
- CVE-2023-42364Medium
A use-after-free vulnerability exists in BusyBox v1.36.1 in the evaluate function in awk.c. An attacker can cause a denial of service via a crafted awk pattern.
- CVE-2023-42363Medium
A use-after-free vulnerability was discovered in the xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.
- CVE-2017-16544High
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature does not sanitize filenames, potentially leading to executing any escape sequences in the terminal.
- CVE-2011-5325High
Directory traversal vulnerability in the BusyBox implementation of tar before version 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.
- CVE-2016-2147High
Integer overflow in the DHCP client (udhcpc) in BusyBox before version 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, leading to an out-of-bounds heap write.
- CVE-2016-6301High
The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service via a forged NTP packet, triggering a communication loop.
- CVE-2026-88841Low
The vulnerability in BusyBox affects the write_status_file() function in the dpkg tool. Failure to reset a stale field cursor between package stanzas leads to out-of-bounds reads and corruption of the status file when removing multiple packages.
Original NVD description (English source)
A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS