Executive brief
BusyBox is a software suite that provides several Unix utilities in a single executable, commonly used in embedded systems and Linux distributions. A vulnerability in its AWK interpreter allows a specially crafted script to crash the application. This results in a denial of service, potentially disrupting system operations or automated tasks that rely on AWK processing.
Technical details
A stack overflow vulnerability exists in the evaluate() function within editors/awk.c of BusyBox (specifically commit 371fe9). The issue stems from a lack of recursion depth tracking in recursive AWK function calls, which can lead to process stack exhaustion. An attacker who can provide a crafted AWK script to be executed by the vulnerable BusyBox binary can trigger this overflow to cause a crash (Denial of Service). A patch has been proposed to implement a MAX_AWK_FUNC_DEPTH limit (set to 1000) to prevent uncontrolled recursion.
Affected products
- BusyBox BusyBox commit 371fe9
Timeline
- 2026-06-16: patched: Patch submitted to BusyBox mailing list by Sanghyun Park
- 2026-07-15: disclosed: CVE published to NVD