CVE-2026-76014

What it is

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account. Limited direct impact.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-19 03:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-08-25 03:16 UTC Last updatedMost recent change to the record

Details

Published

2026-08-19 03:16 UTC

Last modified

2026-08-25 03:16 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-404

Record status

Deferred

Attack profile CVSS 4.0 · 1.9

Attack vector

Local

Complexity

Low

Attack requirements

None

Privileges needed

Low

User interaction

None

Confidentiality

None

Integrity

None

Availability

Low