The vulnerability CVE-2026-26157 in BusyBox arises from incomplete path sanitization in its archive extraction utilities. This flaw allows attackers to craft malicious archives that, when extracted under certain conditions, can write files outside the intended extraction directory. This arbitrary file overwrite can lead to modification of sensitive system files and potentially enable code execution. The issue affects BusyBox packages included in Red Hat Hardened Images RPMs for aarch64 and x86_64 architectures. Red Hat has published an advisory (RHSA-2026:13831) detailing the issue and recommending mitigation steps. The CVSS v3.1 score assigned by Red Hat is 7.0 (High), with attack vector local, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The advisory does not explicitly state a fixed version or patch availability but provides updated RPM versions (busybox-1.37.0-7.2.hum1).

The vulnerability allows an attacker to overwrite arbitrary files outside the intended extraction directory when extracting malicious archives using BusyBox utilities. This can compromise system confidentiality, integrity, and availability by modifying sensitive files or executing unauthorized code. The flaw requires local access and user interaction to exploit, with high complexity. Successful exploitation can lead to arbitrary code execution and denial of service conditions.

Red Hat recommends avoiding extraction of archives from untrusted sources using BusyBox utilities. If extraction of untrusted archives is necessary, it should be performed within a highly isolated and restricted environment, such as a container with a read-only root filesystem and minimal privileges, to limit potential impact. The advisory does not explicitly confirm availability of a patch; therefore, users should monitor Red Hat's official channels for updates and apply any released updates promptly.