Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-76014— BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference

Quick assessment

Affected
n/a BusyBox
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

A mirror to other labs BusyBox是A mirror to other labs组织开源的一款集成了众多精简Unix工具的单一可执行文件。 A mirror to other labs BusyBox 1.30.1及之前版本存在安全漏洞，该漏洞源于networking/wget.c文件中FEATURE_WGET_TIMEOUT Handler组件对参数-T操作不当，导致空指针取消引用。

CVSS 3.3 · Low EPSS 0.16% · P5

Affected Version Matrix 2

VendorProduct Version RangeStatus
n/a BusyBox 1.30.0 affected
1.30.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76014

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Vulnerability Title
A mirror to other labs BusyBox 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
A mirror to other labs BusyBox是A mirror to other labs组织开源的一款集成了众多精简Unix工具的单一可执行文件。 A mirror to other labs BusyBox 1.30.1及之前版本存在安全漏洞，该漏洞源于networking/wget.c文件中FEATURE_WGET_TIMEOUT Handler组件对参数-T操作不当，导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- BusyBox 1.30.0 cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-76014

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-76014

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-76014 (1)

Proof of Concept for CVE-2026-76014 (1)

Other References for CVE-2026-76014 (3)

Same Patch Batch · n/a · 2026-08-19 · 7 CVEs total

CVE-2022-4996 5.3 MEDIUM mruby bigint.c udiv floating point comparison with incorrect operator
CVE-2026-51367 Bottinelli Informatica Vedo Suite 安全漏洞
CVE-2026-51366 Bottinelli Informatica Vedo Suite 安全漏洞
CVE-2026-50719 Ingenic T41 安全漏洞
CVE-2026-50720 Ingenic T31 SoC 安全漏洞
CVE-2026-71694 BOOM: The Berkeley Out-of-Order RISC-V Processor The Berkeley Out-of-Order RISC-V Processo

IV. Related Vulnerabilities

Same product: BusyBox
Same vendor: n/a
Same weakness: CWE-476

V. Comments for CVE-2026-76014

No comments yet

Leave a comment