CVE-2026-88842: Out-of-bounds Read in Red Hat Red Hat Hardened Images
Description
A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.
CVSS v3.1
Score 3.3low
Affected software
Red Hat
Red Hat Hardened Images
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in BusyBox dpkg's write_status_file() function occurs due to failure to reset a field cursor between package stanzas during package removal. When two packages are removed in one invocation and the first package stanza is larger than the second, the second stanza may be omitted from the status file, causing limited data corruption. This flaw affects Red Hat Hardened Images and has a CVSS 3.3 score indicating low severity. There is no indication of a patch or fix in the provided data.
Potential Impact
The impact is limited data corruption in the package status file when removing two packages simultaneously under specific conditions. There is no confidentiality, availability, or broader integrity impact reported. No known exploitation in the wild has been documented.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-88842 for current remediation guidance. Until a fix is available, avoid removing multiple packages simultaneously or monitor package removal operations carefully to detect any anomalies.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-09-10T09:52:23.527Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-88842","vendor":"Red Hat"}]
Threat ID: 6acf5a922cdf04f6566d02a1
Added to database: 10/14/2026, 10:33:54 UTC
Last enriched: 10/14/2026, 10:48:56 UTC
Last updated: 10/14/2026, 19:00:33 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.