CVE catalog

CVE-2026-88842

Severity: Low · CVSS 3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Published: Oct 12, 2026, 5:14:28 PM UTC
Updated: Oct 14, 2026, 11:17:06 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.16% · Oct 25, 2026

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	busybox	sid	`1:1.38.0-3`	vulnerable
Debian	busybox	forky	`1:1.38.0-3`	vulnerable
Debian	busybox	trixie	`1:1.37.0-6`	vulnerable
Debian	busybox	bookworm	`1:1.35.0-4+deb12u1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	busybox	source	sid	`(unfixed)`	not yet assigned	Not reported	[1151678]
Debian	busybox	source	forky	`(unfixed)`	not yet assigned	Not reported	[1151678]
Debian	busybox	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1151678]
Debian	busybox	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1151678]

[Debian bug #1151678]

Notes

[trixie] busybox: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[busybox]Affected
Source package: [busybox]
Details (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Affected
  nvd · busybox · debian · bookworm
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Affected
  nvd · busybox · debian · bookworm
[busybox-static]Affected
Source package: [busybox]
Details (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Affected
  nvd · busybox · debian · bookworm
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Affected
  nvd · busybox · debian · bookworm
[busybox-syslogd]Affected
Source package: [busybox]
Details (2)
- 1:1.35.0-4+deb12u1 · all · bookworm
  Affected
  nvd · busybox · debian · bookworm
- 1:1.35.0-4+deb12u1 · all · bookworm
  Affected
  nvd · busybox · debian · bookworm
[udhcpc]Affected
Source package: [busybox]
Details (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Affected
  nvd · busybox · debian · bookworm
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Affected
  nvd · busybox · debian · bookworm
[udhcpd]Affected
Source package: [busybox]
Details (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Affected
  nvd · busybox · debian · bookworm
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Affected
  nvd · busybox · debian · bookworm

Observed: Oct 23, 2026, 7:39:38 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]