{"id":"CVE-2026-76014","summary":"BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference","details":"A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.","modified":"2026-08-27T19:34:13.756216Z","published":"2026-08-19T02:45:08.531Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-404","CWE-476"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76014.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76014.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76014"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-76014"},{"type":"ADVISORY","url":"https://vuldb.com/submit/878212"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/391923"},{"type":"REPORT","url":"https://github.com/mirror/busybox/issues/124"},{"type":"REPORT","url":"https://vuldb.com/vuln/391923/cti"},{"type":"FIX","url":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff"},{"type":"EVIDENCE","url":"https://gist.github.com/wyxstarry/5c199ec824928c5ae5816aaecbc6df03"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mirror/busybox","events":[{"introduced":"ef800e5441185585986f9b7aaf39010a926fbd5f"},{"fixed":"83a40bf7a93c8ac093d33ab452222dd5b9eb57ff"}],"database_specific":{"extracted_events":[{"introduced":"1.30.0"},{"last_affected":"1.30.0"},{"introduced":"1.30.1"},{"last_affected":"1.30.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["1.30.0","1.30.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76014.json","vanir_signatures_modified":"2026-08-27T19:34:13Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"networking/route.c"},"deprecated":false,"digest":{"line_hashes":["240197968002029010868848462648969086979","64674140455389461115111092525141704387","3720456501478438389834089869088746817","274611335802597996096083653619805735596","249769658752961447456853290224254015964","53606172338091413598408619268121148448","331268885919982182366596421202056929853","106816741962106001614124365827056911819","235348198380064399807158491787312417616","174799228167427875112427076402963172229","241745197577068277470134922221219830263","125054286443649336291304058698626725352","167570956199511829161613969939844366482","145641282864101084748784415925077649207","194121903596045382715987350286880555130","183390285565285869843915866791724221412","78672837405807671643130692282328257050","309909881794903675298900454455467422357","165395273232093388009057293698510828732"],"threshold":0.9},"id":"CVE-2026-76014-00878d82"},{"source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"libbb/hash_md5_sha.c","function":"sha1_end"},"deprecated":false,"digest":{"length":532,"function_hash":"111402498329859723529451195742125158679"},"id":"CVE-2026-76014-00882d50","signature_type":"Function","signature_version":"v1"},{"target":{"file":"coreutils/od_bloaty.c","function":"parse_old_offset"},"deprecated":false,"digest":{"function_hash":"173182106987270861876559946062996602626","length":552},"id":"CVE-2026-76014-01c50523","signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff"},{"source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"coreutils/od_bloaty.c","function":"od_main"},"deprecated":false,"digest":{"function_hash":"290016126296691207902812088902829501524","length":4438},"id":"CVE-2026-76014-02a50c7f","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"networking/ifconfig.c","function":"ifconfig_main"},"deprecated":false,"digest":{"function_hash":"275206676945886921557378513113305411744","length":4923},"id":"CVE-2026-76014-0d1e515c"},{"signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"editors/awk.c","function":"exec_builtin"},"deprecated":false,"digest":{"function_hash":"265715273350558945690798906397279622763","length":3624},"id":"CVE-2026-76014-0e80e974","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"editors/awk.c"},"deprecated":false,"digest":{"line_hashes":["173288521045286784001623655608138657483","33488106746510030617796773059537948170","167604291001973354998492713143120662353","220326401180232806941325774692557680547"],"threshold":0.9},"id":"CVE-2026-76014-1356eefa","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"libpwdgrp/uidgid_get.c","function":"get_uidgid"},"deprecated":false,"digest":{"function_hash":"113201271460302802917452365628430643652","length":763},"id":"CVE-2026-76014-2d845c26","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"37381592968475921118190491921477575091","length":3353},"id":"CVE-2026-76014-35f31898","signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"networking/nslookup.c","function":"parse_reply"}},{"target":{"file":"shell/ash.c","function":"find_builtin"},"deprecated":false,"digest":{"function_hash":"314312768618378867138150447319528323146","length":185},"id":"CVE-2026-76014-42ade15f","signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff"},{"target":{"file":"libbb/get_last_path_component.c","function":"bb_get_last_path_component_nostrip"},"deprecated":false,"digest":{"function_hash":"52882745244452966788772264392811155296","length":175},"id":"CVE-2026-76014-4c88f5d6","signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff"},{"digest":{"function_hash":"74301195314313064146470397303229118484","length":1869},"id":"CVE-2026-76014-4f523f69","signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"networking/route.c","function":"INET6_setroute"},"deprecated":false},{"target":{"function":"vgetopt32","file":"libbb/getopt32.c"},"deprecated":false,"digest":{"length":4867,"function_hash":"234677372504205841331823300032523578385"},"id":"CVE-2026-76014-5dfde682","signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"coreutils/printf.c","function":"print_formatted"},"deprecated":false,"digest":{"function_hash":"28313207312549757071769670492365900575","length":1769},"id":"CVE-2026-76014-6260186a"},{"signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"libbb/hash_md5_sha.c","function":"sha1_begin"},"deprecated":false,"digest":{"function_hash":"40597442648340165180454710206984727540","length":526},"id":"CVE-2026-76014-6c1b2da6","signature_type":"Function"},{"source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"networking/wget.c","function":"wget_main"},"deprecated":false,"digest":{"function_hash":"217192098225453086863496723146093242660","length":4059},"id":"CVE-2026-76014-7599157b","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"178756776610277935776748719632231105858","length":375},"id":"CVE-2026-76014-7d4cbc0d","signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"libbb/xfuncs_printf.c","function":"bb_unsetenv"}},{"deprecated":false,"digest":{"function_hash":"304799488387952491343983231354033011391","length":495},"id":"CVE-2026-76014-7ed702fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"function":"xmalloc_substitute_string","file":"libbb/replace.c"}},{"source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"networking/nbd-client.c","function":"nbdclient_main"},"deprecated":false,"digest":{"function_hash":"324919298722606586757482939389803467334","length":4622},"id":"CVE-2026-76014-803cda1d","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"libbb/hash_md5_sha.c"},"deprecated":false,"digest":{"line_hashes":["326692754995322696429260514207492994542","302214269874708979316565426984287325381","318419114206922179629507451792098012354","149896957249464725001295832765599158278","144847164897528438121551820540761790339","335645921650646729524054114103545875481","28215267952072268844369165951558506022","142602187306134767468267724080816446555","10871218156324719762858373987802049366","68118118728344606470587820177550685827","6265516774987065999786682008237689108","12189768172390524750607367922647332280","248485557287008382770068790854279007781","66580747489548728547023822286114734276","148755060749931309849035920187897753329","243152502346876863264098597205692123909","138729959723105248626951070556663136268","319022268769580583983339282835410211621","8009821046417221621613678065917576924","13801322362345513673634997740297274664","12189768172390524750607367922647332280","326741207084621191483200992884854629192","202386281542319924189307394060013439677","148755060749931309849035920187897753329","286441220116078669795414862386820914807","22255474571374109013010580772097538320","307978378623752768711025988102409521846","154685670485852125010026992572660652993","173058351416943942268538751272551360773"],"threshold":0.9},"id":"CVE-2026-76014-84934a2f","signature_type":"Line"},{"source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"libbb/xfuncs_printf.c"},"deprecated":false,"digest":{"line_hashes":["198368756357657254301786055395320900226","253538415786542877588274468325858507690","98883243389184170463728935725452760906","327995827986887169701994911358955659827","305317882129073719891433881919693699820","177454828787402600035116068537182403252","31956062955434879580378812730733364363","308379752081184367475465388530370869814","49167259084603621227909399959901935881","227138298406798366577464171077540674220","317997326459692623412531817993296917466","124241590096315813371949549199007845695"],"threshold":0.9},"id":"CVE-2026-76014-8e5fc87d","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"185848668152660403798353314210893185267","length":785},"id":"CVE-2026-76014-905f8925","signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"shell/ash.c","function":"decode_dollar_squote"}},{"deprecated":false,"digest":{"line_hashes":["247438385675926062757625349326921905937","276174431954931768578294259664105760721","45583374950696946980028523120692237085","177353365925249959280018368501930933426","49433897003686033800829989226739852934","233478858994162948509550953094007013108","310540833751372376679075928701359814669","324192632792426531789238204742949305291","80948951116257653542844207589216422756"],"threshold":0.9},"id":"CVE-2026-76014-9f13863b","signature_type":"Line","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"networking/nslookup.c"}},{"deprecated":false,"digest":{"line_hashes":["18555601377218925985461548852918136874","120244218326784850335863650369189213339","294250605026335633166315446569147361501","280197194349752590819544877387589713089","194097386793076992305968052604806324897","165179532057723871310916988674415335927","49658636684145827462752334447227822281","123247470429268250205844466811103525410","71412762322724231559480865448259528114","167629609295589706718345262190595118053","334512795267624178506582191518778929240","38312360991828152510050313638240360137","170891518476194762178865107027172562728","94680061047673583859252519388211459655","203263288850555979446271284878482090192","172558162562828716429857901905747699218","265436537625835461716279249404229826194","156931851643510632916238436689580190083","76338669901915597855251893606410803540"],"threshold":0.9},"id":"CVE-2026-76014-a8858a6a","signature_type":"Line","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"shell/ash.c"}},{"deprecated":false,"digest":{"line_hashes":["68540480948947952699592439955516791920","171783905865012071386104245020286276130","156506016074385748309989677111928435716","102060259430052423198252900391970576305"],"threshold":0.9},"id":"CVE-2026-76014-add29a75","signature_type":"Line","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"libbb/replace.c"}},{"digest":{"function_hash":"284594201876325301259622202198134769834","length":269},"id":"CVE-2026-76014-ae9d6122","signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"libbb/strrstr.c","function":"strrstr"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"networking/ifconfig.c"},"deprecated":false,"digest":{"line_hashes":["63192834691459687328690636960052899056","93306177601958802924664295877903760280","92991317136355264705594395361494062555","319495536464765331758230582521387688160","101880439268048404677463113175359175517","167162451737867682457466823666609183529","226208463982677879571861119633211561195","113221409612531349500369171227500258258","103560038238134596705552402046382685812","223529636225036663400446504097649208411","184428011934042219257878687698946570019","118151800398459063925377775649833746460","305619834631113451316597641062325605581"],"threshold":0.9},"id":"CVE-2026-76014-bcf41b35","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"128683640750403393686843374884006424583","length":399},"id":"CVE-2026-76014-bd23a6db","signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"function":"sha256_begin","file":"libbb/hash_md5_sha.c"}},{"digest":{"line_hashes":["274990855418358328731084177761990475388","250255082372175644301450249780820750674","39957312083492826432072233984092316082"],"threshold":0.9},"id":"CVE-2026-76014-bd4c3ed7","signature_type":"Line","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"networking/wget.c"},"deprecated":false},{"digest":{"function_hash":"86516645202230964670616248390336481839","length":460},"id":"CVE-2026-76014-c0641730","signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"archival/libarchive/unsafe_prefix.c","function":"strip_unsafe_prefix"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["109159006665828285684532929883094905246","29536279131616109627894338943791454661","22521951701977577696582709762645601019","203224354093754507563744912515456177329","257289770815322471951231286321891836937","311629066945293237404101757347444927800","329926646764524279494060609295843675689","271156024147250361593516395087596590666","111523348925332798986715426054152016007","117873879224796666742378080926683043410","20202903305153405280766977215510996993","75189242968825647710633436370373154808","298886329359938810389743575544364399089","202966129957523267447044636021901166857","160181459317357641752307490721156159856","195158983830488535523106242247131781477","87893971589962630887019498874270192933"],"threshold":0.9},"id":"CVE-2026-76014-c0e400cf","signature_type":"Line","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"coreutils/od_bloaty.c"}},{"target":{"file":"libbb/getopt32.c"},"deprecated":false,"digest":{"line_hashes":["154334029089084613358579983324416801915","22829840842176779345696488212411541668","275600162189721888378220865059806627147","299047287703428152855995929746032858272","130893163578444116422028120727621773146"],"threshold":0.9},"id":"CVE-2026-76014-c45d7a6e","signature_type":"Line","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff"},{"signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"networking/nbd-client.c"},"deprecated":false,"digest":{"line_hashes":["302610929908222254982669444052022622487","120004894794745828776550512142660717938","134094536095914919179546199822695002615","26608777703022344051352170940450710474"],"threshold":0.9},"id":"CVE-2026-76014-c91d7620","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["120768831155684081812756378126777745346","205860139000949291514705961640303930696","61612099337908289550798067560897179929","54782066840322284156743467660004042504","318711132931179075260713884029327975598","277771488276903673344114793098549835942","48860072387268511871079801448641632001"],"threshold":0.9},"id":"CVE-2026-76014-d8b20b56","signature_type":"Line","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"libbb/get_last_path_component.c"}},{"signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"shell/ash.c","function":"find_command"},"deprecated":false,"digest":{"function_hash":"127399876395390603728060354684831955737","length":3543},"id":"CVE-2026-76014-dd45aeac","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"networking/route.c","function":"INET_setroute"},"deprecated":false,"digest":{"function_hash":"218857365360114901519323640368935418866","length":3369},"id":"CVE-2026-76014-dff8a4ff"},{"signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"coreutils/printf.c"},"deprecated":false,"digest":{"line_hashes":["123804920988489606116528444983934030128","1344252480614409555150648840456482576","172802365466263059292298497148683775397","98603144125365864305745112205306291532","150759278567536278593767542072529662867","277729372345024014289420325650742710568","288699059234434759998790768912888987879","178861759984347232883367710467782582816","285180040162302254731786197157901046762","259311975644810410413312602049445022827","108814359949700661743678969362165488018","64184020549752031244792348427664726952","258360886086393690858153891558707651300","225633849730175547158698889394872458062","84390007118492543366635328212419204631","329341895391992005737329135162703023900","157856581164508369614013776493081301844","70382154484480681961646326238490739037","150914880149111247850417146850861956557","203084575181032470608081737204073446776"],"threshold":0.9},"id":"CVE-2026-76014-eb257e2f","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"libpwdgrp/uidgid_get.c"},"deprecated":false,"digest":{"line_hashes":["18017422454034768956635596121407310819","2169727062163398435695064266463168160","26706953326136019635753831249398843263","27777737270328146408557211282427611275"],"threshold":0.9},"id":"CVE-2026-76014-f0ea70af","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"libbb/strrstr.c"},"deprecated":false,"digest":{"line_hashes":["277198520523204477299940771440749181748","272029223580636603623075237419992586378","233278025271572043363646550899489615948","258361919304175701955750337801478507950","94316182824302780273961131368007806600","298469209265271872515551637143723639743","84774565267313573744033627225370950639","31893230402788524627022413761682809046","70923450666361472997910461377559943546","295353429941625754579367795600981635135"],"threshold":0.9},"id":"CVE-2026-76014-f876120f"},{"signature_version":"v1","source":"https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff","target":{"file":"archival/libarchive/unsafe_prefix.c"},"deprecated":false,"digest":{"line_hashes":["53972634317175329732701426868500940983","88675360999796687110931520553124528782","15067196274025057677599325976022615172","161897076082569202011708771732746892554"],"threshold":0.9},"id":"CVE-2026-76014-fdc5b863","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}]}