busybox has 4 CVEs on record between 2022 and 2026. 1 was published in the last 90 days. The median CVSS is 6.9 (medium), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.9
- Publish → KEV
- —
- Last 90 days
- 1 prev 0
Worst active — by depth score
CVE-2026-92205Medium· 6.1BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability59CVE-2022-48174Critical· 9.8There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.3555CVE-2022-30065High· 7.8A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.43CVE-2023-42366Medium· 5.5A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.30
busybox vulnerabilities
CVEs affecting busybox, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-92205Medium· 6.10dayBusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability
BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this…
CVE-2023-42366Medium· 5.5A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.
A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.
CVE-2022-48174Critical· 9.8There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
CVE-2022-30065High· 7.8A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.