Vulnerability-Lookup

CVE-2026-26158 (GCVE-0-2026-26158)

Vulnerability from cvelistv5 – Published: 2026-02-11 20:27 – Updated: 2026-11-04 22:15

Title

Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries

Summary

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-12 04:55 UTC

CWE

CWE-73 - External Control of File Name or Path

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1131 records in the last 180 days details

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:13831	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-26158	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2439040	issue-trackingx_refsource_REDHAT
https://git.busybox.net/busybox/commit/archival?i…
https://cert-portal.siemens.com/productcert/html/…
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

4 products

Vendor	Product	Version	CPE status
Red Hat	Red Hat Hardened Images	Unaffected: 1.37.0-7.2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:rhel_els:6
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V4.0 (custom)	guessed
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6

Date Public

2026-02-11 00:00

Credits

Red Hat would like to thank Calil Khalil (Hakal) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-26158",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-12T04:55:24.841610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T14:44:23.355Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:01:14.168Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "busybox-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.37.0-7.2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "busybox",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-02-11T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-73",
                "description": "External Control of File Name or Path",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:15:14.401Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-26158"
          },
          {
            "name": "RHBZ#2439040",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439040"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26158.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13831"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:13831: Red Hat Hardened Images"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-02-11T18:09:00.001Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-02-11T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries",
        "workarounds": [
          {
            "lang": "en",
            "value": "As a prevention measure, avoid extracting tar archives from untrusted sources using BusyBox, especially when operating with elevated privileges. If processing untrusted archives is unavoidable, ensure that the extraction process is performed within a strictly sandboxed environment with minimal permissions. This operational control reduces the risk of arbitrary file modification and privilege escalation."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "busybox-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.37.0-7.2.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "busybox",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Calil Khalil (Hakal) for reporting this issue."
        }
      ],
      "datePublic": "2026-02-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T22:15:35.293Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:13831",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:13831"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-26158"
        },
        {
          "name": "RHBZ#2439040",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439040"
        },
        {
          "url": "https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-11T18:09:00.001Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-02-11T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries",
      "workarounds": [
        {
          "lang": "en",
          "value": "As a prevention measure, avoid extracting tar archives from untrusted sources using BusyBox, especially when operating with elevated privileges. If processing untrusted archives is unavoidable, ensure that the extraction process is performed within a strictly sandboxed environment with minimal permissions. This operational control reduces the risk of arbitrary file modification and privilege escalation."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-73: External Control of File Name or Path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-26158",
    "datePublished": "2026-02-11T20:27:06.979Z",
    "dateReserved": "2026-02-11T17:05:41.991Z",
    "dateUpdated": "2026-11-04T22:15:35.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-26158",
      "date": "2026-11-07",
      "epss": "0.0019",
      "percentile": "0.08682"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:hummingbird:1"
                ],
                "defaultStatus": "affected",
                "packageName": "busybox-main",
                "product": "Red Hat Hardened Images",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "1.37.0-7.2.hum1",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:rhel_els:6"
                ],
                "defaultStatus": "unknown",
                "packageName": "busybox",
                "product": "Red Hat Enterprise Linux 6",
                "vendor": "Red Hat"
              }
            ],
            "source": "secalert@redhat.com"
          },
          {
            "affectedData": [
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:hummingbird:1"
                ],
                "defaultStatus": "affected",
                "packageName": "busybox-main",
                "product": "Red Hat Hardened Images",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "1.37.0-7.2.hum1",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:6"
                ],
                "defaultStatus": "unknown",
                "packageName": "busybox",
                "product": "Red Hat Enterprise Linux 6",
                "vendor": "Red Hat"
              }
            ],
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
          },
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "RUGGEDCOM RST2428P",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V4.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files."
          },
          {
            "lang": "es",
            "value": "Se encontr\u00f3 una falla en BusyBox. Esta vulnerabilidad permite a un atacante modificar archivos fuera del directorio de extracci\u00f3n previsto al crear un archivo tar malicioso que contiene entradas de hardlink o symlink no validadas. Si el archivo tar se extrae con privilegios elevados, esta falla puede conducir a una escalada de privilegios, permitiendo a un atacante obtener acceso no autorizado a archivos cr\u00edticos del sistema."
          }
        ],
        "id": "CVE-2026-26158",
        "lastModified": "2026-11-04T23:17:26.200",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "secalert@redhat.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-26158",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-12T04:55:24.841610Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-02-11T21:16:21.607",
        "references": [
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2026:13831"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/security/cve/CVE-2026-26158"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439040"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:13831"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/security/cve/CVE-2026-26158"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439040"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26158.json"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-73"
              }
            ],
            "source": "secalert@redhat.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-73"
              }
            ],
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-11-04T22:15:30+00:00",
      "cve": "CVE-2026-26158",
      "id": "CVE-2026-26158",
      "initial_release_date": "2026-02-11T00:00:00+00:00",
      "product_status:fixed": "7",
      "product_status:known_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26158.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "defaultStatus": "unknown",
                "product": "RUGGEDCOM RST2428P",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V4.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-02T13:01:14.168Z",
              "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
              "shortName": "siemens-SADP"
            },
            "references": [
              {
                "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
              }
            ],
            "x_adpType": "supplier"
          },
          {
            "affected": [
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:hummingbird:1"
                ],
                "defaultStatus": "affected",
                "packageName": "busybox-main",
                "product": "Red Hat Hardened Images",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "1.37.0-7.2.hum1",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:6"
                ],
                "defaultStatus": "unknown",
                "packageName": "busybox",
                "product": "Red Hat Enterprise Linux 6",
                "vendor": "Red Hat"
              }
            ],
            "datePublic": "2026-02-11T00:00:00.000Z",
            "descriptions": [
              {
                "lang": "en",
                "value": "A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files."
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "namespace": "https://access.redhat.com/security/updates/classification/",
                    "value": "Important"
                  },
                  "type": "Red Hat severity rating"
                }
              },
              {
                "cvssV3_1": {
                  "attackComplexity": "HIGH",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "REQUIRED",
                  "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                },
                "format": "CVSS"
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-73",
                    "description": "External Control of File Name or Path",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-15T01:15:14.401Z",
              "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
              "shortName": "redhat-SADP"
            },
            "references": [
              {
                "tags": [
                  "vdb-entry",
                  "x_refsource_REDHAT"
                ],
                "url": "https://access.redhat.com/security/cve/CVE-2026-26158"
              },
              {
                "name": "RHBZ#2439040",
                "tags": [
                  "issue-tracking",
                  "x_refsource_REDHAT"
                ],
                "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439040"
              },
              {
                "tags": [
                  "x_sadp-csaf-vex"
                ],
                "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26158.json"
              },
              {
                "tags": [
                  "vendor-advisory",
                  "x_refsource_REDHAT"
                ],
                "url": "https://access.redhat.com/errata/RHSA-2026:13831"
              }
            ],
            "solutions": [
              {
                "lang": "en",
                "value": "RHSA-2026:13831: Red Hat Hardened Images"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2026-02-11T18:09:00.001Z",
                "value": "Reported to Red Hat."
              },
              {
                "lang": "en",
                "time": "2026-02-11T00:00:00.000Z",
                "value": "Made public."
              }
            ],
            "title": "busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries",
            "workarounds": [
              {
                "lang": "en",
                "value": "As a prevention measure, avoid extracting tar archives from untrusted sources using BusyBox, especially when operating with elevated privileges. If processing untrusted archives is unavoidable, ensure that the extraction process is performed within a strictly sandboxed environment with minimal permissions. This operational control reduces the risk of arbitrary file modification and privilege escalation."
              }
            ],
            "x_adpType": "supplier",
            "x_generator": {
              "engine": "sadp-cli 1.0.0"
            }
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-26158",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-02-11T20:50:07.296261Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-02-11T20:50:11.404Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:hummingbird:1"
              ],
              "defaultStatus": "affected",
              "packageName": "busybox-main",
              "product": "Red Hat Hardened Images",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1.37.0-7.2.hum1",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:rhel_els:6"
              ],
              "defaultStatus": "unknown",
              "packageName": "busybox",
              "product": "Red Hat Enterprise Linux 6",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Calil Khalil (Hakal) for reporting this issue."
            }
          ],
          "datePublic": "2026-02-11T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Important"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-73",
                  "description": "External Control of File Name or Path",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-11-04T22:15:35.293Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "name": "RHSA-2026:13831",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2026:13831"
            },
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-26158"
            },
            {
              "name": "RHBZ#2439040",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439040"
            },
            {
              "url": "https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-02-11T18:09:00.001Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-02-11T00:00:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries",
          "workarounds": [
            {
              "lang": "en",
              "value": "As a prevention measure, avoid extracting tar archives from untrusted sources using BusyBox, especially when operating with elevated privileges. If processing untrusted archives is unavoidable, ensure that the extraction process is performed within a strictly sandboxed environment with minimal permissions. This operational control reduces the risk of arbitrary file modification and privilege escalation."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-73: External Control of File Name or Path"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-26158",
        "datePublished": "2026-02-11T20:27:06.979Z",
        "dateReserved": "2026-02-11T17:05:41.991Z",
        "dateUpdated": "2026-11-04T22:15:35.293Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

SSA-253495

Vulnerability from csaf_siemens - Published: 2026-06-02 00:00 - Updated: 2026-06-02 00:00

Summary

SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.0

Scope

77 vulnerabilities in this advisory, including CVE-2026-26158.

CVE-2026-26158

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Known affected: 1 product

https://support.industry.siemens.com/cs/ww/en/view/110002573/

Open the full advisory

SUSE-SU-2026:0758-1

Vulnerability from csaf_suse - Published: 2026-03-03 12:16 - Updated: 2026-09-16 19:07

Summary

Security update for busybox

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2026-26158.

CVE-2026-26158

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 128 products

Open the full advisory

SUSE-SU-2026:0759-1

Vulnerability from csaf_suse - Published: 2026-03-03 12:16 - Updated: 2026-03-03 12:16

Summary

Security update for busybox

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2026-26158.

CVE-2026-26158

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 8 products

Open the full advisory

SUSE-SU-2026:0872-1

Vulnerability from csaf_suse - Published: 2026-03-11 17:06 - Updated: 2026-03-11 17:06

Summary

Security update for busybox

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2026-26158.

CVE-2026-26158

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 20 products

Open the full advisory

SUSE-SU-2026:0892-1

Vulnerability from csaf_suse - Published: 2026-03-13 09:05 - Updated: 2026-09-16 19:09

Summary

Security update for busybox

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2026-26158.

CVE-2026-26158

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 17 products

Open the full advisory

SUSE-SU-2026:20726-1

Vulnerability from csaf_suse - Published: 2026-03-16 09:25 - Updated: 2026-09-20 18:36

Summary

Security update for freetype2

Severity

Moderate

Scope

1 vulnerability in this advisory.

Open the full advisory

SUSE-SU-2026:20905-1

Vulnerability from csaf_suse - Published: 2026-03-18 15:27 - Updated: 2026-09-16 19:37

Summary

Security update for busybox

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2026-26158.

CVE-2026-26158

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 20 products

Open the full advisory

UBUNTU-CVE-2026-26158 (CVE-2026-26158)

Vulnerability from osv_ubuntu – Published: 2026-02-11 21:16 – Updated: 2026-10-17 09:39 – Source website

Details

Severity

7.0 (High)


                    
                      CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-26158	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-26158	REPORT
	https://access.redhat.com/security/cve/CVE-2026-26158	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.21.0-1ubuntu1.4+esm1?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.20.0-8.1ubuntu1",
        "1:1.20.0-9ubuntu1",
        "1:1.20.0-9ubuntu2",
        "1:1.21.0-1ubuntu1",
        "1:1.21.0-1ubuntu1.4",
        "1:1.21.0-1ubuntu1.4+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.22.0-15ubuntu1.4+esm2?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.22.0-15ubuntu1",
        "1:1.22.0-15ubuntu1.4",
        "1:1.22.0-15ubuntu1.4+esm1",
        "1:1.22.0-15ubuntu1.4+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.27.2-2ubuntu3.4+esm1?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.22.0-19ubuntu2",
        "1:1.27.2-1ubuntu3",
        "1:1.27.2-1ubuntu4",
        "1:1.27.2-2ubuntu2",
        "1:1.27.2-2ubuntu3",
        "1:1.27.2-2ubuntu3.1",
        "1:1.27.2-2ubuntu3.2",
        "1:1.27.2-2ubuntu3.3",
        "1:1.27.2-2ubuntu3.4",
        "1:1.27.2-2ubuntu3.4+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.30.1-4ubuntu6.5?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.30.1-4ubuntu4",
        "1:1.30.1-4ubuntu5",
        "1:1.30.1-4ubuntu6",
        "1:1.30.1-4ubuntu6.1",
        "1:1.30.1-4ubuntu6.2",
        "1:1.30.1-4ubuntu6.3",
        "1:1.30.1-4ubuntu6.4",
        "1:1.30.1-4ubuntu6.5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.30.1-7ubuntu3.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.30.1-6ubuntu3",
        "1:1.30.1-7ubuntu1",
        "1:1.30.1-7ubuntu2",
        "1:1.30.1-7ubuntu3",
        "1:1.30.1-7ubuntu3.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.36.1-6ubuntu3.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.36.1-3ubuntu1",
        "1:1.36.1-6ubuntu1",
        "1:1.36.1-6ubuntu3",
        "1:1.36.1-6ubuntu3.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.37.0-4ubuntu1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.37.0-4ubuntu1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.37.0-4ubuntu1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.37.0-4ubuntu1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.37.0-4ubuntu1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.37.0-4ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.37.0-4ubuntu1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.37.0-4ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.38.0-3ubuntu4"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.38.0-3ubuntu4"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.38.0-3ubuntu4"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.38.0-3ubuntu4"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.38.0-3ubuntu4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.38.0-3ubuntu4?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.37.0-7ubuntu1",
        "1:1.37.0-10.1ubuntu2",
        "1:1.37.0-10.1ubuntu3",
        "1:1.38.0-3ubuntu1",
        "1:1.38.0-3ubuntu3",
        "1:1.38.0-3ubuntu4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.37.0-7ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.37.0-7ubuntu1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.37.0-4ubuntu1",
        "1:1.37.0-7ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.",
  "id": "UBUNTU-CVE-2026-26158",
  "modified": "2026-10-17T09:39:33Z",
  "published": "2026-02-11T21:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-26158"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-26158"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-26158"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-26158"
  ]
}

WID-SEC-W-2026-0395

Vulnerability from csaf_certbund - Published: 2026-02-11 23:00 - Updated: 2026-05-05 22:00

Summary

BusyBox: Mehrere Schwachstellen

Severity

Mittel

Scope

2 vulnerabilities in this advisory, including CVE-2026-26158.

CVE-2026-26158

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-26158 (GCVE-0-2026-26158)

UBUNTU-CVE-2026-26158 (CVE-2026-26158)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour