CVE-2026-88832

HighCVSS 7.3/10Last modified Sep 25, 2026

Description

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 25, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-888336.5A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an CVE-2026-888343.7A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in ce CVE-2026-888356.1BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.CVE-2026-888376.5BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.CVE-2026-888385.5A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing CVE-2026-888396.7BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.CVE-2026-88846.4The Instant-Quote.co Quotation Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versio CVE-2026-888405.3BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.CVE-2026-888423.3A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages CVE-2026-888437.2The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to CVE-2026-888442.7The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returni CVE-2026-888454.3The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative ma