CVE-2026-26157 is a vulnerability in BusyBox's archive extraction utilities included in Red Hat Hardened Images. The issue arises from incomplete path sanitization, allowing attackers to craft malicious archives that, when extracted under specific conditions, can write files outside the intended extraction directory. This can lead to arbitrary file overwrite, which may enable code execution by altering sensitive system files. Red Hat has issued a security advisory (RHSA-2026:13831) providing updated BusyBox RPMs (version 1.37.0-7.2.hum1) that fix this vulnerability. The CVSS 3.1 vector indicates the attack requires local access with high complexity, no privileges, and user interaction, but can result in high confidentiality, integrity, and availability impacts.

Successful exploitation can allow an attacker to overwrite arbitrary files on the system outside the intended extraction directory. This can lead to code execution through modification of sensitive system files, compromising system confidentiality, integrity, and availability. The vulnerability requires local access and user interaction, with a high attack complexity.

Red Hat has released updated BusyBox packages (busybox-1.37.0-7.2.hum1 and related RPMs) that address this vulnerability. Users of Red Hat Hardened Images should apply these updates promptly to remediate the issue. Refer to the Red Hat advisory RHSA-2026:13831 for detailed update instructions. No alternative mitigations are indicated in the advisory.