CVE-2026-90954
7.8HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-59
Impact
Attackers can write arbitrary files anywhere on the filesystem, potentially achieving code execution as the extracting user. They need a user or automated job to unpack a maliciously crafted .deb archive with BusyBox dpkg-deb.
Root cause
The ar archive handler flushes deferred symlinks prematurely after processing each archive member rather than waiting until the entire archive is unpacked.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Fixed versions are not specified in the advisory; avoid extracting untrusted .deb archives with BusyBox dpkg-deb, or switch to GNU binutils/dpkg-deb until patched vendor packages drop.
$ busybox dpkg-deb --help || dpkg --versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.