CVE-2026-88832 — Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overfl…

CVE-2026-88832

Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow PUBLISHED

Description (CNA)

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.

Affected (CNA)

Vendor / product	Versions
Red Hat / Red Hat Hardened Images	unaffected 1.37.0-9.1.hum1 before *

CWE

CWE-787

References

https://access.redhat.com/errata/RHSA-2026:72111
https://access.redhat.com/security/cve/CVE-2026-88832
https://bugzilla.redhat.com/show_bug.cgi?id=2531345

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.