Is CVE-2026-90954 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90954 being exploited in the wild.

How severe is CVE-2026-90954?

High severity, with a CVSS score of 7.8, published 14 October 2026.

Which products and versions are affected?

BusyBox all versions with dpkg-deb applet enabled.

How is CVE-2026-90954 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-90954?

Check whether you run BusyBox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90954: BusyBox dpkg-deb path traversal in archive extraction

CVE-2026-90954 · Severity: high · CVSS 7.8 · Published 2026-10-14

BusyBox is a lightweight version of Linux utilities used in embedded systems, containers, and build environments. A flaw in its dpkg-deb package extraction tool allows an attacker to write files outside the intended directory when a user extracts a specially crafted .deb package, potentially compromising system integrity or enabling code execution.

Technologies: BusyBox.

Quick answers

Is CVE-2026-90954 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90954 being exploited in the wild.
How severe is CVE-2026-90954?: High severity, with a CVSS score of 7.8, published 14 October 2026.
Which products and versions are affected?: BusyBox all versions with dpkg-deb applet enabled.
Is there a fix for CVE-2026-90954?: No fixed version is recorded yet. Do not use BusyBox dpkg-deb to extract untrusted .deb packages; use Debian's reference dpkg-deb implementation instead. If BusyBox dpkg-deb must be used, inspect .deb archives for multiple data.tar members before extraction, as legitimate packages contain exactly one.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-14"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90954 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-90954?: Check whether you run BusyBox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Do not use BusyBox dpkg-deb to extract untrusted .deb packages; use Debian's reference dpkg-deb implementation instead. If BusyBox dpkg-deb must be used, inspect .deb archives for multiple data.tar members before extraction, as legitimate packages contain exactly one.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-14"}]

Technical details

The vulnerability exploits improper symlink handling in BusyBox's ar archive handler, which flushes deferred symlinks after each archive member rather than at extraction completion. An attacker crafts a .deb archive with two data.tar members: the first declares an unsafe symlink to an absolute path (e.g., '/'), and after the first member's processing, this symlink becomes active. The second member then traverses this symlink to write a regular file outside the extraction directory. This requires the user to extract an untrusted .deb file, and a fix is available by using Debian's reference dpkg-deb implementation.

Affected products

BusyBox all versions with dpkg-deb applet enabled

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.