Read the docs
TI-2026-53214 Aliases CVE-2026-76014GHSA-xwfg-2qxj-cwwg

BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference

Priority MEDIUM 55CWE-404Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Deferred Red Hat: fix deferred

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-404.

Summary

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00121 1st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—BusyBox1.30.0; 1.30.1—No fix listedCNA
  • BusyBox Vendor— Affected 1.30.0; 1.30.1 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*——busybox
  • cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:* Versions — — ·busybox

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix yet: Fix deferred
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76014
  2. 2026-10-03 Alias added: GHSA-xwfg-2qxj-cwwg

References

Exploit 1

Patch 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences