Data Corruption Vulnerability in BusyBox dpkg Software
CVE-2026-88842

3.3LOW

Key Information:

Vendor

Red Hat
Status
Red Hat Hardened Images
Vendor
CVE Published:
14 October 2026

What is CVE-2026-88842?

A flaw exists in the BusyBox dpkg software where the write_status_file() function fails to reset the field cursor between package stanzas. This issue arises during the removal of two packages in a single execution. If the first package's stanza is larger than the second's, the second package's stanza may be omitted from the status file, leading to potential data corruption and compromise of the integrity of the package management system.

References

https://access.redhat.com/security/cve/CVE-2026-88842
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2531355
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.
.