CVE-2026-76014: BusyBox Buffer Overflow Vulnerability

CVE-2026-76014 Overview

CVE-2026-76014 is a null pointer dereference vulnerability in BusyBox versions up to 1.30.1. The flaw resides in the networking/wget.c file within the FEATURE_WGET_TIMEOUT handler. Manipulation of the -T (timeout) argument triggers the null pointer dereference, causing the wget applet to crash. The issue is classified under [CWE-404] (Improper Resource Shutdown or Release). Exploitation requires local access and low privileges, and results in limited availability impact on the wget process. A patch is available in the upstream BusyBox repository under commit 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff.

Critical Impact
A local, low-privileged user can crash the BusyBox wget applet by supplying a malformed -T argument, producing a denial-of-service condition against that process.

Affected Products

BusyBox versions up to and including 1.30.1
BusyBox builds compiled with the FEATURE_WGET_TIMEOUT option enabled
Embedded Linux distributions and container images bundling vulnerable BusyBox releases

Discovery Timeline

2026-08-19 - CVE-2026-76014 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76014

Vulnerability Analysis

The vulnerability affects the wget applet shipped with BusyBox. The FEATURE_WGET_TIMEOUT handler processes the -T command-line flag, which sets a network timeout value for the download operation. Under specific conditions, code paths tied to this handler dereference a pointer that has not been initialized, producing a segmentation fault. The impact is limited to the availability of the wget process invoked by the local user. There is no confidentiality or integrity impact. According to public exploit metadata, proof-of-concept code has been disclosed publicly on a GitHub Gist, lowering the barrier to reproduction.

Root Cause

The root cause is improper resource handling within the timeout initialization logic of networking/wget.c, categorized as [CWE-404]. The handler fails to validate an internal pointer before use when the -T argument is manipulated, producing a null pointer dereference during network setup.

Attack Vector

The attack vector is local. An authenticated local user invokes the BusyBox wget applet with a crafted -T argument that traverses the vulnerable branch of the FEATURE_WGET_TIMEOUT handler. The result is a crash of the wget process. The vulnerability does not permit code execution, privilege escalation, or lateral movement.

See the upstream fix in the GitHub BusyBox Commit Log and the corresponding GitHub BusyBox Issue Discussion for technical details.

text

# Patch scaffolding introduced with the fix (.dockerignore additions)
+.git
+*.o
+*.a
+*.so
+*.d
+*.cmd
+busybox
+busybox_unstripped*
+include/config
+include/applet_tables.h
+include/bbconfigopts.h
+include/common_bufsiz.h
+include/embedded_scripts.h
+include/NUM_APPLETS.h
+include/usage.h
+include/usage_compressed.h
+applets/applets.o
+applets/built-in.o
+*/built-in.o
+_install
+.tmp_versions
+.config.old
# Source: https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff

Detection Methods for CVE-2026-76014

Indicators of Compromise

Unexpected segmentation faults or SIGSEGV events tied to the BusyBox wget binary in system logs or dmesg output.
Core dump artifacts referencing wget.c in the FEATURE_WGET_TIMEOUT code path.
Repeated invocations of busybox wget -T <value> from non-administrative user contexts.

Detection Strategies

Enumerate BusyBox binaries across endpoints, containers, and embedded devices and compare their version strings against 1.30.1 and earlier.
Enable process crash telemetry to capture faulting binaries and inspect crashes originating from busybox or symlinked wget handlers.
Correlate command-line telemetry for wget -T invocations with subsequent process termination events on the same host.

Monitoring Recommendations

Track execve events referencing BusyBox wget in EDR or auditd logs, capturing the full argument vector.
Alert on abnormal frequencies of wget crashes on production embedded systems where the applet is expected to run non-interactively.
Include BusyBox in software bill of materials (SBOM) scans to identify vulnerable versions in container images.

How to Mitigate CVE-2026-76014

Immediate Actions Required

Apply the upstream BusyBox patch identified by commit hash 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff and rebuild affected images.
Inventory all systems running BusyBox 1.30.1 or earlier, including firmware, container base images, and appliance builds.
Restrict shell access on multi-user systems so that untrusted local users cannot repeatedly invoke busybox wget.

Patch Information

The fix is available in the upstream BusyBox source tree. Refer to the GitHub BusyBox Commit Log for the patch content and to the VulDB CVE-2026-76014 Entry for advisory metadata. Downstream distributions should backport the commit and rebuild BusyBox binaries. Container image maintainers should rebuild from patched base layers.

Workarounds

Disable the FEATURE_WGET_TIMEOUT build option in BusyBox .config where the -T flag is not required by dependent scripts.
Remove or restrict execute permissions on the BusyBox wget applet symlink on systems that do not rely on it.
Replace BusyBox wget with an alternative HTTP client such as curl where the operating environment permits.

bash

# Rebuild BusyBox from a patched source tree
git clone https://github.com/mirror/busybox.git
cd busybox
git cherry-pick 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff
make defconfig
# Optionally disable the vulnerable feature
sed -i 's/^CONFIG_FEATURE_WGET_TIMEOUT=y/# CONFIG_FEATURE_WGET_TIMEOUT is not set/' .config
make -j"$(nproc)"