CVE-2021-42386

—

CVSS 3.1

7.2 high

EPSS

3%p85

Published

Nov 15, 2021 (Nov 15, 2021)

Modified

Jun 17, 2026

Description

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function

Vendors: busybox fedoraproject
Products: busybox, fedora
Weakness: CWE-416
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.7%)

In the news2 stories

Experts found 14 new flaws in BusyBox

Security AffairsNov 10, 11:38 UTC · Nov 10, 2021Vulnerability CVE-2021-42373 CVE-2021-42374 CVE-2021-42375+11 CVEs

14 New Security Flaws Found in BusyBox Linux Utility for Embedded Devices

The Hacker NewsNov 10, 08:08 UTC · Nov 10, 2021Vulnerability CVE-2021-42373 CVE-2021-42386 CVE-2021-42374+11 CVEs