A high-severity stack overflow vulnerability in BusyBox allows unauthenticated remote attackers to crash the system via a crafted AWK script.

This is a stack overflow vulnerability occurring within the evaluate() function located in editors/awk.c. The vulnerability is accessible to unauthenticated remote attackers who can supply a malicious AWK script to the BusyBox interpreter.

The vulnerability carries a CVSS score of 7.5, indicating a high level of risk primarily due to the potential for service disruption. Successful exploitation results in a Denial of Service condition, which can cause critical system processes to crash, leading to unplanned downtime and potential operational failure for infrastructure relying on BusyBox.

Immediate Action: Review the BusyBox project mailing list and advisory at https://lists.busybox.net/pipermail/busybox/2026-June/092351.html to identify the specific patched version or commit and apply the update immediately.

Proactive Monitoring: Monitor system logs for unexpected crashes or service restarts that may indicate an attempt to trigger the stack overflow through malicious AWK script execution.

Compensating Controls: Implement input validation or restrict access to environments where users can execute arbitrary AWK scripts within the BusyBox suite to limit the attack surface.

Public Exploit Available: False

Given the high CVSS score and the potential for service disruption, organizations using BusyBox should prioritize verifying their current version against the vendor advisory. Apply the necessary updates or patches as soon as they are made available by the maintainers to prevent potential Denial of Service attacks.