CVE-2026-38752: BusyBox AWK DoS Vulnerability

CVE-2026-38752 Overview

CVE-2026-38752 is a stack overflow vulnerability in the evaluate() function located in editors/awk.c of BusyBox commit 371fe9. Attackers can trigger a Denial of Service (DoS) condition by supplying a crafted AWK script to the BusyBox AWK interpreter. BusyBox is widely deployed in embedded systems, IoT devices, and Linux-based container images, which broadens the exposure of this issue. The vulnerability requires the target to process attacker-controlled AWK input, and successful exploitation causes the affected process to crash.

Critical Impact
A crafted AWK script processed by a vulnerable BusyBox build crashes the interpreter, disrupting scripts, init routines, and automated pipelines that rely on BusyBox awk.

Affected Products

BusyBox commit 371fe9 (editors/awk.c)
Downstream distributions and images bundling the affected BusyBox commit
Embedded and IoT firmware built with the vulnerable BusyBox source

Discovery Timeline

2026-07-15 - CVE-2026-38752 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-38752

Vulnerability Analysis

The flaw resides in the evaluate() function of the BusyBox AWK implementation in editors/awk.c. The function is responsible for evaluating AWK expressions and executing the parsed script logic. A crafted AWK script forces the evaluator into a code path that exhausts the process stack, producing a stack overflow condition and terminating the interpreter.

Because evaluate() handles recursive expression evaluation, an attacker-controlled input structure can drive the function into unbounded or excessively deep recursion. Exhausting the stack aborts the running BusyBox process, which affects any workflow that depends on the AWK interpreter for text processing.

The issue is categorized as a Stack Overflow leading to Denial of Service [CWE-121 / CWE-674]. Confidentiality and integrity are not directly impacted, but availability is degraded whenever BusyBox awk processes untrusted input.

Root Cause

The root cause is the absence of recursion depth or expression complexity limits within evaluate(). When the interpreter parses and evaluates a deeply nested or recursively structured AWK expression, each nested evaluation consumes additional stack frames until the process stack is exhausted.

Attack Vector

An attacker must supply a malicious AWK script to a system that executes it with the vulnerable BusyBox awk. Realistic attack surfaces include CGI scripts, log processing pipelines, build systems, and embedded device management interfaces that pass user-supplied input into awk. Exploitation does not yield code execution but reliably crashes the interpreter.

No verified public proof-of-concept code has been referenced in the advisory. Technical discussion is available on the BusyBox Mailing List Archive.

Detection Methods for CVE-2026-38752

Indicators of Compromise

Repeated crashes or segmentation faults of the busybox or awk process on affected systems.
Kernel log entries referencing stack overflow or SIGSEGV signals tied to BusyBox invocations.
Unexpected termination of scripts, cron jobs, or init routines that invoke BusyBox awk.

Detection Strategies

Inventory hosts, containers, and firmware images for BusyBox builds derived from commit 371fe9 or earlier vulnerable revisions.
Monitor process telemetry for abnormal termination signals affecting awk invocations under BusyBox.
Scan container images and embedded firmware with software composition analysis tools that flag vulnerable BusyBox versions.

Monitoring Recommendations

Alert on repeated non-zero exit codes from BusyBox awk executions in production pipelines.
Correlate crash events with the source of AWK input to identify attacker-controlled data paths.
Track outbound requests and scheduled tasks that feed user input into BusyBox utilities for anomalous patterns.

How to Mitigate CVE-2026-38752

Immediate Actions Required

Identify all systems, containers, and firmware images shipping the affected BusyBox commit and prioritize those exposed to untrusted input.
Restrict which processes and users can pass arbitrary scripts to BusyBox awk, especially in network-facing services.
Validate and sanitize any user-supplied input before it reaches the AWK interpreter.

Patch Information

No formal patched release is referenced in the current NVD entry. Monitor the BusyBox Mailing List Archive and the BusyBox Official Website for upstream fixes, and rebuild affected images once a corrected commit is available.

Workarounds

Replace BusyBox awk with a non-affected AWK implementation such as gawk or mawk where feasible.
Enforce input size and complexity limits on AWK scripts processed by BusyBox.
Apply operating system resource limits (ulimit -s) to contain the impact of stack exhaustion on shared hosts.
Isolate services that invoke BusyBox awk inside containers or sandboxes with restart policies to preserve availability.

bash

# Configuration example: constrain BusyBox awk exposure
# 1. Verify BusyBox version and applet configuration
busybox --help | head -n 1
busybox awk --help 2>&1 | head -n 5

# 2. Prefer a non-BusyBox awk when available
if command -v gawk >/dev/null 2>&1; then
    alias awk='gawk'
fi

# 3. Restrict resources for processes that must use busybox awk
ulimit -s 2048          # cap stack size (KB)
ulimit -t 5             # cap CPU seconds per process