CVE-2026-26158
High · 7.0CVSS
7.0
EPSS
0.2%
Published
Feb 11, 2026
CISA due date
—
The record
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | busybox | 0 | 1.35.0-150400.3.14.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | busybox | 0 | 1.35.0-150400.3.14.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | busybox | 0 | 1.37.0-150500.10.17.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | busybox | 0 | 1.37.0-150500.10.17.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | busybox | 0 | 1.37.0-150700.18.15.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | busybox | 0 | 1.35.0-150400.3.14.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | busybox | 0 | 1.37.0-150500.10.17.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | busybox | 0 | 1.37.0-150500.10.17.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | busybox | 0 | 1.35.0-150400.3.14.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | busybox | 0 | 1.37.0-150500.10.17.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | busybox | 0 | 1.37.0-150500.10.17.1 |
| openSUSE:Leap 15.6 | busybox | 0 | 1.37.0-150500.10.17.1 |
| openSUSE:Leap 15.6 | busybox-links | 0 | 1.37.0-150500.7.11.1 |
| openSUSE:Leap 16.0 | busybox | 0 | 1.37.0-160000.5.1 |
| openSUSE:Tumbleweed | busybox | 0 | 1.37.0-9.1 |
Related vulnerabilities
- CVE-2026-26157 A flaw was found in BusyBox. Also affects busybox
- CVE-2025-60876 BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in… Also affects busybox
- CVE-2026-29004 BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6… Also affects busybox
- CVE-2011-5325 Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5… Also affects busybox
- CVE-2016-2148 Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows… Also affects busybox
- CVE-2026-88899 knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request… CWE-73
- CVE-2026-53956 Rattler is a library that provides common functionality used within the conda ecosystem. CWE-73
- CVE-2026-79692 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-73