CVE-2026-88839 — Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

CVE-2026-88839

Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint PUBLISHED

Description (CNA)

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.

Vendor / product	Versions
Red Hat / Red Hat Hardened Images	unaffected 1.37.0-9.1.hum1 before *

CWE-787

CISA-ADP

No English description supplied.

No references supplied.