The vulnerability CVE-2026-26157 affects BusyBox components within Red Hat Hardened Images. Due to incomplete path sanitization during archive extraction, an attacker can craft malicious archives that, when extracted under specific conditions, write files outside the intended directory. This flaw can result in arbitrary file overwrite, which may lead to code execution through modification of sensitive system files. The CVSS v3.1 base score is 7.0, reflecting high impact on confidentiality, integrity, and availability. Red Hat has issued security updates for BusyBox RPMs (version 1.37.0-7.2.hum1) to fix this vulnerability.

Successful exploitation allows an attacker with local access to extract malicious archives that overwrite arbitrary files outside the extraction directory. This can compromise system integrity and confidentiality, potentially enabling code execution by modifying critical system files. The vulnerability has a CVSS score of 7.0, indicating high severity. There are no known exploits in the wild at this time.

Red Hat has released updated BusyBox RPMs as part of Red Hat Hardened Images to address CVE-2026-26157. Users should apply the security update RHSA-2026:13831 promptly to remediate this vulnerability. Refer to Red Hat's official advisory at https://access.redhat.com/errata/RHSA-2026:13831 for detailed update instructions. No alternative mitigations or workarounds are specified by the vendor.