CVE-2026-38753 Use after free in BusyBox

Medium 4.9 Published 15 Jul 2026 Updated 20 Jul 2026

Attackers can cause a denial of service in BusyBox by supplying a crafted AWK script that triggers a use-after-free vulnerability.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-38753?

CVE-2026-38753 is a medium-severity use after free vulnerability in BusyBox, published on 15 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

Weakness: CWE-416

Which versions are affected by CVE-2026-38753?

It affects 1 product.

Products include Busybox Busybox.

How do I fix CVE-2026-38753?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-38753 being exploited?

There is no known exploitation of CVE-2026-38753 in the wild and no public exploit code.

Sources

Also known as AZL-92832, DEBIAN-CVE-2026-38753, ECHO-7f94-d993-4cdc, GHSA-9r55-p3jw-v652, MINI-f3hf-m5x8-f8fv, UBUNTU-CVE-2026-38753.