CVE-2026-88842Low· 3.3▾ SunlitA flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second pac…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-90954High· 7.8A flaw was found in BusyBox's dpkg-deb archive extraction
CVE-2026-88829High· 7.2A flaw was found in BusyBox httpd's reverse proxy feature
CVE-2026-84838High· 7.8A flaw was found in rpmuncompress
CVE-2026-84837High· 7.8A flaw was found in rpm
CVE-2026-78367High· 7.0A vulnerability was found in RPM's rpmbuild tarball processing
CVE-2026-94603Critical· 10.0Podman is a tool for managing OCI containers and pods