Log in Start free

BusyBox

Products

ProductCVEsExploitedLatest
BusyBox21–Oct 21, 2026

Exploited and recent CVEs

  • CVE-2026-92205 Medium 6.1 BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability 0.3%
  • CVE-2026-38753 Medium 4.9 A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script. 0.1%
  • CVE-2026-38752 Low 2.9 A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script. 0.2%
  • CVE-2026-38755 Low 2.9 A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input. 0.2%
  • CVE-2026-38754 Medium 5.1 A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input. 0.2%
  • CVE-2025-46394 Low 3.2 In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences. 0.2%
  • CVE-2024-58251 Low 2.5 In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) whe 0.2%
  • CVE-2021-42385 High 7.2 A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function 2.8%
  • CVE-2021-42374 Medium 5.3 An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format tha 0.6%
  • CVE-2021-42375 Medium 5.5 An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved chara 0.4%
  • CVE-2021-42384 High 7.2 A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function 2.7%
  • CVE-2021-42376 Unrated A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for 0.4%
  • CVE-2021-42378 High 7.2 A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function 2.7%
  • CVE-2021-42382 High 7.2 A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function 2.8%
  • CVE-2021-42381 High 7.2 A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function 2.8%
  • CVE-2021-42373 Unrated A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given 0.4%
  • CVE-2021-42383 High 7.2 A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function 2.2%
  • CVE-2021-42386 High 7.2 A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function 2.7%
  • CVE-2021-42377 Unrated An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string 3.6%
  • CVE-2021-42379 High 7.2 A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function 2.8%
  • CVE-2021-42380 High 7.2 A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function 3.1%