Low severity · published Aug 19, 2026
CVE-2026-76014
BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
BusyBox · Busybox
1.30.0; 1.30.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76014
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76014
gist.github.com
https://gist.github.com/wyxstarry/5c199ec824928c5ae5816aaecbc6df03
github.com
https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff
github.com
https://github.com/mirror/busybox/issues/124
vuldb.com
https://vuldb.com/cve/CVE-2026-76014
vuldb.com
https://vuldb.com/submit/878212
vuldb.com
https://vuldb.com/vuln/391923
More from BusyBox
9.8
CVE-2022-48174
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35
9.8
CVE-2021-42377
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell…
9.8
CVE-2018-1000517
BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap…
9.8
CVE-2016-2148
Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing
8.8
CVE-2022-28391
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal