Junglewise Threat Intelligence

CVE-2026-88839: BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.

CVE-2026-88839 · Severity: medium · CVSS 6.7 · Published 2026-09-23

Executive brief

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.