Is CVE-2026-88840 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88840 being exploited in the wild.

How severe is CVE-2026-88840?

Medium severity, with a CVSS score of 5.3, published 23 September 2026.

Is there a fix for CVE-2026-88840?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-88840 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-88840?

Check whether you run Busybox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88840: BusyBox TLS out-of-bounds read in ClientHello parsing

CVE-2026-88840 · Severity: medium · CVSS 5.3 · Published 2026-09-23

BusyBox includes a TLS test utility (ssl_server) that processes incoming TLS handshake messages from network clients. When a malformed ClientHello message is truncated, the utility reads past the end of its input buffer, potentially exposing sensitive data such as cryptographic keys or memory addresses. This vulnerability primarily affects systems using BusyBox ssl_server in production, though Red Hat notes it is not compiled into their default Fedora packages.

Technologies: Busybox. Vendors: Busybox.

Quick answers

Is CVE-2026-88840 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88840 being exploited in the wild.
How severe is CVE-2026-88840?: Medium severity, with a CVSS score of 5.3, published 23 September 2026.
Which products and versions are affected?: Busybox unknown.
Is there a fix for CVE-2026-88840?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88840 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-88840?: Check whether you run Busybox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability exists in the get_client_hello() function of BusyBox's TLS implementation when parsing truncated ClientHello messages. The flaw occurs because the code does not validate buffer bounds before reading the compression-methods length byte. An unauthenticated attacker on the network can send a crafted TLS handshake message to trigger the read, leaking adjacent memory contents or potentially causing a denial of service crash.

Affected products

BusyBox BusyBox unknown

Timeline

2026-09-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.