CVE-2026-26158

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

• CWE-73
• CWE-73

• https://access.redhat.com/errata/RHSA-2026:13831
• https://access.redhat.com/security/cve/CVE-2026-26158
• https://bugzilla.redhat.com/show_bug.cgi?id=2439040
• https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb
• https://access.redhat.com/errata/RHSA-2026:13831
• https://access.redhat.com/security/cve/CVE-2026-26158
• https://bugzilla.redhat.com/show_bug.cgi?id=2439040
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26158.json

Published

Feb 11, 2026

Last Modified

Jul 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26152Insecure storage of sensitive information in Windows Cryptog…7
• CVE-2026-26153Out-of-bounds read in Windows Encrypting File System (EFS) a…7.8
• CVE-2026-26154Improper input validation in Windows Server Update Service a…7.5
• CVE-2026-26155Microsoft Local Security Authority Subsystem Service Informa…6.5
• CVE-2026-26156Heap-based buffer overflow in Windows Hyper-V allows an unau…7.8
• CVE-2026-26157A flaw was found in BusyBox. Incomplete path sanitization in…7
• CVE-2026-26159Missing authentication for critical function in Windows Remo…7.8
• CVE-2026-2616A vulnerability has been found in Beetel 777VR1 up to 01.00.…9.8
• CVE-2026-26160Missing authentication for critical function in Windows Remo…7.8
• CVE-2026-26161Untrusted pointer dereference in Windows Sensor Data Service…7.8
• CVE-2026-26162Access of resource using incompatible type ('type confusion'…7.8
• CVE-2026-26163Double free in Windows Kernel allows an authorized attacker …7.8