Insecure Archive Extraction in BusyBox Affects Multiple Versions
CVE-2026-26157

7HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 6; Red Hat Hardened Images
Vendor: CVE Published:; 11 February 2026

What is CVE-2026-26157?

A vulnerability exists in the archive extraction utilities of BusyBox due to inadequate path sanitization. This weakness allows attackers to create malicious archives that, when extracted, can write files outside the designated directory. Under specific conditions, such actions may lead to the overwriting of critical system files, potentially enabling unauthorized code execution by compromising the integrity of the system.