ZeroDay Findings
Sign inSign up

Findings

CVE-2026-88842

A flaw was found in BusyBox dpkg.

Published Oct 14, 2026 · updated Oct 15, 2026

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · OSV.dev

    Detected

    A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

  2. Oct 15, 2026 · OSV.dev

    Updated

    A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

  3. Oct 15, 2026 · NIST NVD

    Updated

    A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

Affected

  • Debian:12 busybox1:1.35.0-4, 1:1.35.0-4+deb12u1, 1:1.36.0-1~exp1
  • Debian:13 busybox1:1.37.0-10, 1:1.37.0-10.1, 1:1.37.0-6
  • Debian:14 busybox1:1.37.0-10, 1:1.37.0-10.1, 1:1.37.0-6

Sources

  • CVE.orgVulnerability recordCVE-2026-88842

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-88842

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2026-88842

    A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status

    nvd.nist.gov
  • OSV.devPackage advisoryDEBIAN-CVE-2026-88842
    osv.dev

References