CVE-2026-26157

HighCVSS 7.0/10Last modified Jul 15, 2026

Description

A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published
Feb 11, 2026
Last modified
Jul 15, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-261587.0A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting CVE-2026-261597.8Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privilegesCVE-2026-26169.8A vulnerability has been found in Beetel 777VR1 up to 01.00.09. The impacted element is an unknown function of the component Web Management CVE-2026-261607.8Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privilegesCVE-2026-261617.8Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.CVE-2026-261627.8Access of resource using incompatible type ('type confusion') in Windows OLE allows an authorized attacker to elevate privileges locally.CVE-2026-261637.8Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-261647.5Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclCVE-2026-261657.0Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.CVE-2026-261667.0Double free in Windows Shell allows an authorized attacker to elevate privileges locally.CVE-2026-261677.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorizCVE-2026-261687.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock
CVE-2026-26157: High severity, CVSS 7.0 | Vulnix