CVE-2026-76014 in BusyBox
Summary
by MITRE • 08/19/2026
A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within BusyBox, a widely used software suite that provides compact versions of many common UNIX utilities, specifically affecting the wget utility component up through version 1.30.1. The flaw is located in the networking/wget.c source file and is triggered by the FEATURE_WGET_TIMEOUT handler when processing command-line arguments. This vulnerability represents a critical failure in input validation logic within the network retrieval tool, which is frequently embedded in resource-constrained environments such as routers, IoT devices, and embedded Linux systems where BusyBox serves as the primary userland environment.
The technical nature of this flaw involves an improper handling of the timeout argument specified via the -T flag during wget execution. When a specific manipulation or malformed value is passed to this parameter, it leads to a null pointer dereference within the application's memory space. In C-based applications like BusyBox, such errors occur when the program attempts to access a memory address that has not been allocated or initialized correctly. This typically happens because the code fails to verify whether a pointer returned by an allocation function or retrieved from user input is valid before attempting to dereference it for reading or writing operations.
From an operational perspective, this vulnerability allows for local denial of service attacks against systems running the affected BusyBox version. Since local access is required to approach this attack, the threat actor must already have some level of shell access or command execution capability on the target device. Once triggered, the null pointer dereference causes the wget process to crash abruptly. While this does not directly lead to remote code execution in its current form, it disrupts network-dependent tasks that rely on wget for data retrieval, updates, or synchronization. In embedded systems where automated scripts frequently utilize wget for configuration pulls or firmware checks, such crashes can cause service interruptions and potentially destabilize the broader system if watchdog timers fail to restart the process correctly.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-476, which describes a NULL Pointer Dereference weakness. It also relates to CWE-20, Improper Input Validation, as the root cause is the failure to adequately sanitize or validate the timeout argument before it influences internal pointer logic. In terms of adversary tactics, this falls under MITRE ATT&CK technique T1564.003, Hidden Files and Directories, if used in conjunction with other techniques to obscure malicious activity, but more directly maps to disruptive actions that degrade system availability rather than confidentiality or integrity breaches.
To remediate this issue, organizations must apply the specific patch identified by commit hash 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff to their BusyBox builds. This involves updating the source code in the networking/wget.c file to include proper null checks before dereferencing pointers derived from user-supplied timeout arguments. For embedded device manufacturers, this requires rebuilding the firmware with the patched version of BusyBox and distributing an update to end-users. System administrators managing standalone Linux installations should upgrade their busybox package through official distribution repositories if available. Until patches are applied, mitigations include restricting local shell access to trusted users only and monitoring for abnormal process terminations related to wget operations in automated scripts.