CVE-2026-88842 — Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption
A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation an…
Published: 2026-10-14 · CVSS: 3.3 · CVSS 3.1
A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7