CVE-2026-26158

HighCVSS 7.0/10Last modified Jul 15, 2026

Description

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published
Feb 11, 2026
Last modified
Jul 15, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-261597.8Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privilegesCVE-2026-26169.8A vulnerability has been found in Beetel 777VR1 up to 01.00.09. The impacted element is an unknown function of the component Web Management CVE-2026-261607.8Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privilegesCVE-2026-261617.8Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.CVE-2026-261627.8Access of resource using incompatible type ('type confusion') in Windows OLE allows an authorized attacker to elevate privileges locally.CVE-2026-261637.8Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-261647.5Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclCVE-2026-261657.0Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.CVE-2026-261667.0Double free in Windows Shell allows an authorized attacker to elevate privileges locally.CVE-2026-261677.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorizCVE-2026-261687.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSockCVE-2026-261696.1Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally.