{"id":"AZL-109773","summary":"CVE-2026-88842 affecting package busybox 1.36.1-27","details":"A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.","modified":"2026-10-21T14:17:40.900641832Z","published":"2026-10-14T11:17:06Z","upstream":["CVE-2026-88842"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88842"}],"affected":[{"package":{"name":"busybox","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/busybox"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.36.1-27"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109773.json"}}],"schema_version":"1.9.0"}