CVE-2026-38755 Details
Description
A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
A heap overflow vulnerability has been identified in Busybox version 1.38.0, specifically within the evalcommand function in shell/ash.c. This vulnerability allows attackers to cause a denial-of-service condition by supplying crafted input that leads to a heap overflow.
Users can upgrade to Busybox versions that include the patch for this vulnerability. The patch addresses the heap overflow by implementing a function recursion limit, preventing excessive recursion that could lead to a stack overflow.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://busybox.net | [email protected] | |
| https://lists.busybox.net/pipermail/busybox/2026-June/092354.html | [email protected] | Mailing ListPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
| CWE-122 | Heap-based Buffer Overflow | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| busybox busybox | 1.38.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | [email protected] |
| Jul 16, 2026 | Initial Analysis | [email protected] |
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |