# CVE-2026-38752: BusyBox stack overflow in AWK evaluate function

Source: https://junglewise.ai/threats/cve-2026-38752-busybox-stack-overflow-in-awk-evaluate-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-38752 · Severity: info · Published 2026-07-15

BusyBox is a software suite that provides several Unix utilities in a single executable, commonly used in embedded systems and Linux distributions. A vulnerability in its AWK interpreter allows a specially crafted script to crash the application. This results in a denial of service, potentially disrupting system operations or automated tasks that rely on AWK processing.

Technologies: [Busybox](https://junglewise.ai/threats/technologies/busybox). Vendors: [Busybox](https://junglewise.ai/threats/vendors/busybox).

## Quick answers

**Is CVE-2026-38752 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-38752 being exploited in the wild.

**How severe is CVE-2026-38752?** Informational severity, published 15 July 2026.

**Which products and versions are affected?** Busybox commit 371fe9.

**Is there a fix for CVE-2026-38752?** A patch was published on 2026-06-16: Patch submitted to BusyBox mailing list by Sanghyun Park Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-38752 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-38752?** Check whether you run Busybox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack overflow vulnerability exists in the evaluate() function within editors/awk.c of BusyBox (specifically commit 371fe9). The issue stems from a lack of recursion depth tracking in recursive AWK function calls, which can lead to process stack exhaustion. An attacker who can provide a crafted AWK script to be executed by the vulnerable BusyBox binary can trigger this overflow to cause a crash (Denial of Service). A patch has been proposed to implement a MAX_AWK_FUNC_DEPTH limit (set to 1000) to prevent uncontrolled recursion.

## Affected products

- BusyBox BusyBox commit 371fe9

## Timeline

- 2026-06-16: patched: Patch submitted to BusyBox mailing list by Sanghyun Park
- 2026-07-15: disclosed: CVE published to NVD

## References

- [http://busybox.com/](http://busybox.com/)
- [https://lists.busybox.net/pipermail/busybox/2026-June/092351.html](https://lists.busybox.net/pipermail/busybox/2026-June/092351.html)

## Related threats

- [BusyBox divide-by-zero in volume identification FAT parser](https://junglewise.ai/threats/cve-2026-124742-a-flaw-was-found-in-busybox-the-volume-identification-component)
- [BusyBox httpd stack buffer overflow in subdirectory config](https://junglewise.ai/threats/cve-2026-124739-a-flaw-was-found-in-busybox-when-the-httpd-web-server-processes)
- [BusyBox heap buffer overflow in TFTP client](https://junglewise.ai/threats/cve-2026-124737-a-flaw-was-found-in-busybox-when-the-tftp-trivial-file-transfer)
- [BusyBox libarchive symlink directory traversal arbitrary file creation](https://junglewise.ai/threats/cve-2026-92205-busybox-libarchive-symlink-directory-traversal-arbitrary-file)
- [BusyBox udhcpc integer underflow in DHCP packet processing](https://junglewise.ai/threats/cve-2026-88833-a-flaw-was-found-in-busybox-s-udhcpc-dhcp-client-when-processing)