This vulnerability involves an out-of-bounds write caused by BusyBox romfs volume ID parsing using an unbounded strlen on attacker-controlled metadata. This leads to a heap buffer overflow when processing specially crafted romfs filesystem images with BusyBox utilities blkid or findfs. A local attacker with low privileges and user interaction can trigger this flaw, potentially resulting in code execution, memory corruption, or denial of service. The issue specifically affects Red Hat Hardened Images, and Fedora users are advised to use util-linux versions of these utilities instead. The vulnerability is tracked as CVE-2026-88832 with a CVSS 3.1 score of 7.3 (high).

An attacker with local access who processes a crafted romfs filesystem image using BusyBox blkid or findfs can cause a heap buffer overflow, potentially leading to unauthorized code execution, modification of memory, and denial of service through crashes. The impact includes high confidentiality, integrity, and availability consequences. However, exploitation requires local user interaction and the presence of vulnerable BusyBox utilities. On Fedora, the default utilities are not setuid, which mitigates the risk of exploitation.

Avoid processing untrusted romfs filesystem images with BusyBox blkid or findfs. Use the util-linux versions of these utilities instead, which are the default on Fedora. There is no explicit mention of an official patch or fix currently available for Red Hat Hardened Images; therefore, patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-88832 for updates. No additional vendor-recommended mitigations are provided.