Use-After-Free Vulnerability in Busybox awk Subroutine

CVE-2026-38753

What is CVE-2026-38753?

A vulnerability exists in the awk_sub() function of Busybox v1.38.0 that allows an attacker to exploit a use-after-free condition. By providing a specially crafted AWK script, an attacker can cause a Denial of Service, disrupting normal operations and potentially compromising the system's functionality. Users of Busybox should ensure they are aware of this issue and take necessary precautions to mitigate potential attacks.

References