High severity · published Feb 11, 2026
CVE-2026-26158
Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries
7.0
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor, CISA
RH
Red Hat Hardened Images · Red Hat
All versions, or not specified · source: vendor, CISA
RR
RUGGEDCOM RST2428P · Siemens
before V4.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26158
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-26158
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:13831
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-26158
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2439040
git.busybox.net
https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-253495.html
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26158.json
More from Red Hat Enterprise Linux 6
8.8
CVE-2025-31277
Apple Multiple Products Buffer Overflow Vulnerability
7.5
CVE-2026-34486
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
10.0
CVE-2026-4692
Sandbox escape in the Responsive Design Mode component
10.0
CVE-2026-4689
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
10.0
CVE-2026-4688
Sandbox escape due to use-after-free in the Disability Access APIs component