CVE-2026-88842: Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption
A flaw was found in BusyBox dpkg. The writestatusfile() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.
Other sources
A vulnerability exists in the BusyBox dpkg applet in archival/dpkg.c. The writestatusfile() function does not reset the fieldstart cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the stale cursor causes readpackagefield() to read past the second stanza's buffer.
Observable consequences include: silent data corruption (the second package stanza vanishes from the status file), potential heap information leakage, and crashes under ASan.
— Red Hat
Busybox: busybox: dpkg stale fieldstart pointer causes out-of-bounds read and status file corruption
— Microsoft
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the BusyBox dpkg applet are exposed when a single dpkg invocation removes two packages and the first package's status stanza is larger than the second package's stanza.
Does exploitation require privileges or user interaction?
The supplied vector indicates local attack access, low attack complexity, no privileges required, and user interaction required. The provided data does not identify the specific user action involved.
What are the observable effects of a successful trigger?
The second package stanza can disappear from the dpkg status file, resulting in limited status-file data corruption. The flaw may also cause an out-of-bounds read, potential heap-information leakage, and crashes under ASan.