CVE-2026-88840 Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello
An out-of-bounds read in BusyBox TLS server allows attackers to cause denial of service or potentially execute code via truncated ClientHello messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88840?
CVE-2026-88840 is a medium-severity memory corruption vulnerability in Red Hat Hardened Images, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.
Weakness: CWE-125
Which versions are affected by CVE-2026-88840?
How do I fix CVE-2026-88840?
No fix has been published for CVE-2026-88840 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-88840 being exploited?
There is no known exploitation of CVE-2026-88840 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-88840, ECHO-0f33-f9b7-76c3, GHSA-w878-vhh4-m5pv, UBUNTU-CVE-2026-88840.