CVE Feed

    Dashboard / CVE / CVE-2026-124745

    CVE-2026-124745

    A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system.

    Published:Nov 11, 2026
    Last Modified:Nov 13, 2026
    EPS:Nov 11, 2026
    EPSS Score:0.00171
    CVSS Score:6.3

    Affected Products

    Vendor
    Busybox
    Product
    Busybox
    Vendor
    Red Hat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Hardened Images
    Vendor
    Redhat
    Product
    Hummingbird
    Vendor
    Redhat
    Product
    Rhel Els

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-124746 (CVSS 5.5) — A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer bou…
    CVE-2026-92205 (CVSS 6.1) — BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allow…
    CVE-2026-88829 (CVSS 7.2) — A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests ma…
    CVE-2026-90954 (CVSS 7.8) — A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks af…
    CVE-2026-88838 (CVSS 5.5) — A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /et…
    CVE-2026-88834 (CVSS 3.7) — A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user ex…
    CVE-2026-88833 (CVSS 6.5) — A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the va…
    CVE-2026-108119 (CVSS 6.3) — A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries…
    CVE-2026-88830 (CVSS 7.5) — A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer…
    CVE-2026-88832 (CVSS 7.3) — BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer o…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High