CVE-2026-38753 Details
Description
A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
A use-after-free vulnerability has been identified in Busybox version 1.38.0 within the awk_sub() function in editors/awk.c. This vulnerability allows attackers to cause a denial-of-service by supplying a crafted AWK script. The issue arises because the function evaluates a regular expression argument, which can modify the replacement text pointer, creating a dangling reference that can be exploited.
Users can apply the available patch, which copies the replacement string before processing the regular expression, ensuring stable storage during the operation. The patch is included in the Busybox mailing list.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://busybox.net | [email protected] | |
| https://lists.busybox.net/pipermail/busybox/2026-June/092352.html | [email protected] | Mailing ListPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | CISA-ADP |
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| busybox busybox | 1.38.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | [email protected] |
| Jul 20, 2026 | CVE Modified | [email protected] |
| Jul 16, 2026 | Initial Analysis | [email protected] |
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |