CVE-2026-38754 Details

A heap overflow vulnerability has been identified in Busybox version 1.38.0 within the ifsbreakup() function in shell/ash.c. This vulnerability allows attackers to cause a denial-of-service condition by supplying crafted input. The issue arises because the function skips over escape characters before checking the following byte against the internal field separator (IFS). If an escape character is the last byte in the processed region, the function can read one byte past the end, leading to a heap overflow. Additionally, the recorded region can become stale after error handling, creating further potential for exploitation.