Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Affects Red Hat Product Security Red HatSource GCVE Database
Mentioned vulnerabilities
Not known to be exploited · CVSS 7.5 High.
Data as of 10/25/2026, 09:04:00 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Red Hat Product Security Red Hat | Affected
| Fixed in– |
AI-suggested
Red Hat advises limiting exposure by avoiding execution of untrusted AWK scripts in BusyBox. Users should ensure BusyBox instances are not configured to process arbitrary or untrusted AWK script input, especially in critical system environments. The advisory includes updated BusyBox RPMs; users should apply these updates as per Red Hat's instructions at https://images.redhat.com/. Patch status is not explicitly confirmed; users should consult the Red Hat advisory for current remediation guidance.
Description
This update includes the following RPMs: busybox: * busybox-1.37.0-8.2.hum1 (aarch64, x86_64) * busybox-petitboot-1.37.0-8.2.hum1 (aarch64, x86_64) * busybox-shared-1.37.0-8.2.hum1 (aarch64, x86_64) * busybox-1.37.0-8.2.hum1.src (src) Security Fix(es): busybox: * CVE-2026-38752 * CVE-2026-38755
Impact
The vulnerability can lead to a denial of service condition by crashing or hanging the BusyBox process when processing a malicious AWK script. This can make affected systems or applications unavailable to legitimate users. The impact is limited to environments where BusyBox is configured to execute AWK scripts from untrusted sources. There is no indication of confidentiality or integrity impact, and no known active exploitation in the wild.
Summary
The vulnerability CVE-2026-38752 is a stack overflow in the evaluate() function of BusyBox's AWK interpreter. This flaw allows a remote attacker to cause a denial of service (DoS) by supplying a specially crafted AWK script, resulting in the BusyBox instance becoming unresponsive. The issue affects BusyBox packages version 1.37.0-8.2.hum1 included in Red Hat Hardened Images RPMs for aarch64 and x86_64 architectures. The vulnerability is rated as medium severity by Red Hat and is associated with CWE-120 (buffer overflow). Red Hat has released updated RPMs to address this issue, but the advisory does not explicitly confirm the fixed version or patch availability. Mitigation involves avoiding execution of untrusted AWK scripts in BusyBox environments.
Weaknesses
- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #11
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
References
- access.redhat.com/errata/RHSA-2026:42074 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-38752 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-38755 (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- images.redhat.com (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42074.json (opens in a new tab)