What’s Vulnerable › Vulnerabilities

CVE-2026-26158: Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-11 · updated 2026-07-15
• Weakness: CWE-73

Description

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Affected products

• Red Hat Hardened Images: all versions — fixed in 1.37.0-7.2.hum1

How to fix

Upgrade to a fixed version: Red Hat Hardened Images 1.37.0-7.2.hum1. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:13831
• https://access.redhat.com/security/cve/CVE-2026-26158
• https://bugzilla.redhat.com/show_bug.cgi?id=2439040
• https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb
• https://access.redhat.com/errata/RHSA-2026:13831
• https://access.redhat.com/security/cve/CVE-2026-26158
• https://bugzilla.redhat.com/show_bug.cgi?id=2439040
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26158.json

Get alerted when CVE-2026-26158 or the next vulnerability affects your stack