CVE-2026-26158

HIGH

7.0

Description

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

CVE Details

CVSS v3.1 Score7.0

SeverityHIGH

CVSS VectorCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack VectorLOCAL

ComplexityHIGH

Privileges RequiredNONE

User InteractionREQUIRED

Published2/11/2026

Last Modified2/12/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-73

References

https://access.redhat.com/security/cve/CVE-2026-26158(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2439040(secalert@redhat.com)

https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb(secalert@redhat.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.