CVE-2026-38752 Details
Description
A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
A stack overflow vulnerability has been identified in BusyBox within the AWK editor component, specifically in the evaluate() function of awk.c. This issue arises from commit 371fe9, where attackers can cause a denial-of-service condition by supplying a crafted AWK script. The vulnerability allows recursive AWK functions to repeatedly enter the evaluate() function, exhausting the process stack and leading to a crash.
Users can apply the patch included in the BusyBox mailing list discussion to address this vulnerability. This patch modifies the evaluate() function to track the depth of recursive function calls and prevent stack overflow by enforcing a recursion limit.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://busybox.net/ | [email protected] | |
| https://lists.busybox.net/pipermail/busybox/2026-June/092351.html | [email protected] | Mailing ListPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | CISA-ADP |
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| busybox busybox | 2024-07-13 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | [email protected] |
| Jul 20, 2026 | CVE Modified | [email protected] |
| Jul 16, 2026 | Initial Analysis | [email protected] |
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |