The vulnerability CVE-2026-38752 is a stack overflow in the evaluate() function of BusyBox's AWK interpreter. This flaw allows a remote attacker to cause a denial of service (DoS) by supplying a specially crafted AWK script, resulting in the BusyBox instance becoming unresponsive. The issue affects BusyBox packages version 1.37.0-8.2.hum1 included in Red Hat Hardened Images RPMs for aarch64 and x86_64 architectures. The vulnerability is rated as medium severity by Red Hat and is associated with CWE-120 (buffer overflow). Red Hat has released updated RPMs to address this issue, but the advisory does not explicitly confirm the fixed version or patch availability. Mitigation involves avoiding execution of untrusted AWK scripts in BusyBox environments.

The vulnerability can lead to a denial of service condition by crashing or hanging the BusyBox process when processing a malicious AWK script. This can make affected systems or applications unavailable to legitimate users. The impact is limited to environments where BusyBox is configured to execute AWK scripts from untrusted sources. There is no indication of confidentiality or integrity impact, and no known active exploitation in the wild.

Red Hat advises limiting exposure by avoiding execution of untrusted AWK scripts in BusyBox. Users should ensure BusyBox instances are not configured to process arbitrary or untrusted AWK script input, especially in critical system environments. The advisory includes updated BusyBox RPMs; users should apply these updates as per Red Hat's instructions at https://images.redhat.com/. Patch status is not explicitly confirmed; users should consult the Red Hat advisory for current remediation guidance.