CVE-2026-88835 — Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb p…

CVE-2026-88835

Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages PUBLISHED

Description (CNA)

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.

Vendor / product	Versions
Red Hat / Red Hat Hardened Images	unaffected 1.37.0-9.1.hum1 before *

CWE-125

CISA-ADP

No English description supplied.

No references supplied.