Security Flaw in BusyBox Affects Archive Extraction Process
CVE-2026-124745

6.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 6
Red Hat Hardened Images
Vendor
CVE Published:
11 November 2026

What is CVE-2026-124745?

A vulnerability has been identified in BusyBox's tar utility that improperly resolves deferred hardlink targets when extracting archives. This flaw allows an attacker to create a specially crafted archive that links to sensitive files outside of the intended extraction directory. As a result, subsequent extraction operations could potentially overwrite arbitrary files on the vulnerable system, thereby compromising data integrity and security.

References

https://access.redhat.com/security/cve/CVE-2026-124745
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2571637
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank ducanhluu for reporting this issue.
.