CVE-2026-26157highCWE-73

CVE-2026-26157: high-severity vulnerability in Red Hat Enterprise Linux 6

Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization

Published · Updated

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7epss 0.7%
from disclosure to weapon78 days
Published on NVDFeb 11
1st PoC+78d
exploitation probability
0.7%top 48% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Red Hat · Red Hat Enterprise Linux 6Red Hat · Red Hat Hardened Images
public PoCs found — 1
exploitdbwww.exploit-db.com/exploits/52538unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Red Hat Enterprise Linux 6

In the same product, most dangerous first.

CVE-2023-4911HIGHGlibc: buffer overflow in ld.so leading to privilege escalationEPSS 63.8%KEVCVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2024-3094CRITICALXz: malicious code in distributed sourceEPSS 90.9%CVE-2024-12084CRITICALRsync: heap buffer overflow in rsync due to improper checksum length handlingEPSS 72.1%CVE-2023-1183MEDIUMArbitrary file writeEPSS 64.6%CVE-2023-34966HIGHSamba: infinite loop in mdssvc rpc service for spotlightEPSS 62.4%
References
https://access.redhat.com/errata/RHSA-2026:13831https://access.redhat.com/security/cve/CVE-2026-26157https://bugzilla.redhat.com/show_bug.cgi?id=2439039https://cert-portal.siemens.com/productcert/html/ssa-253495.htmlhttps://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cbhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26157.json