This security advisory from Red Hat addresses two vulnerabilities identified as CVE-2026-26157 and CVE-2026-26158 in busybox packages included in Red Hat Hardened Images RPMs. The affected packages include busybox-1.37.0-7.2.hum1 variants for aarch64 and x86_64 architectures. The vulnerabilities are related to CWE-73, which involves improper handling of external control over file names or paths. The advisory references updated RPMs containing security fixes but does not specify fixed version numbers. The CVSS vector provided for CVE-2026-26157 indicates a high severity with local attack vector, high complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability.

The vulnerabilities impact busybox packages used in Red Hat Hardened Images on aarch64 and x86_64 platforms. The CVSS vector for CVE-2026-26157 shows high impact on confidentiality, integrity, and availability, indicating that successful exploitation could lead to significant compromise of affected systems. No known exploits in the wild have been reported at this time.

Red Hat has released updated busybox RPMs (version 1.37.0-7.2.hum1) for affected architectures to address these vulnerabilities. Users of Red Hat Hardened Images should apply these updates as provided by Red Hat to remediate the issues. Since this is an RPM update, following the standard Red Hat update procedures for these packages is recommended. Patch status is confirmed by the vendor advisory indicating the availability of fixed RPMs.