The vulnerability CVE-2026-88835 affects the BusyBox dpkg applet in Red Hat Hardened Images. The read_package_field() function improperly reads beyond the NUL terminator in malformed .deb packages, resulting in an out-of-bounds heap read. This can cause the application to crash or potentially leak adjacent heap memory contents. Red Hat notes that Fedora systems, which use RPM, are not practically affected by this issue. The vulnerability has a CVSS v3.1 score of 6.1 with local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.

An attacker who can supply a crafted .deb package to the BusyBox dpkg applet may cause the applet to crash (denial of service) or potentially leak adjacent heap memory. The leaked memory could contain sensitive information such as cryptographic keys or memory addresses that might aid in further attacks. The vulnerability does not impact integrity but can affect availability and confidentiality to a limited extent. There is no indication of active exploitation in the wild.

Red Hat advises not to use the BusyBox dpkg applet to process untrusted .deb packages. Instead, use the full dpkg implementation if Debian package handling is required. No official patch or fix is currently confirmed; users should monitor the Red Hat advisory for updates. Since the BusyBox dpkg applet has no practical deployment scenario on Fedora systems, those users are not affected.