Which CVEs affect BusyBox 1.38.0?
| CVE | Severity | CVSS | Fixed from | Note |
|---|---|---|---|---|
| CVE-2022-30065 | high | 7.8 | not stated | per vulnerability databases |
| CVE-2023-39810 | high | 7.8 | not stated | per vulnerability databases |
| CVE-2026-90954 | high | 7.8 | not stated | per vulnerability databases |
| CVE-2026-124741 | high | 7.6 | not stated | per vulnerability databases |
| CVE-2026-124737 | high | 7.5 | not stated | per vulnerability databases |
| CVE-2026-124739 | high | 7.5 | not stated | per vulnerability databases |
| CVE-2026-124747 | high | 7.5 | not stated | per vulnerability databases |
| CVE-2026-88830 | high | 7.5 | not stated | per vulnerability databases |
| CVE-2026-88832 | high | 7.3 | not stated | per vulnerability databases |
| CVE-2026-29004 | high | 7.2 | not stated | per vulnerability databases |
| CVE-2026-88829 | high | 7.2 | not stated | per vulnerability databases |
| CVE-2026-26157 | high | 7.0 | not stated | per vulnerability databases |
| CVE-2026-26158 | high | 7.0 | not stated | per vulnerability databases |
| CVE-2026-88839 | medium | 6.7 | not stated | per vulnerability databases |
| CVE-2026-88833 | medium | 6.5 | not stated | per vulnerability databases |
| CVE-2026-88837 | medium | 6.5 | not stated | per vulnerability databases |
| CVE-2026-108119 | medium | 6.3 | not stated | per vulnerability databases |
| CVE-2026-124744 | medium | 6.3 | not stated | per vulnerability databases |
| CVE-2026-124745 | medium | 6.3 | not stated | per vulnerability databases |
| CVE-2026-88835 | medium | 6.1 | not stated | per vulnerability databases |
| CVE-2026-92205 | medium | 6.1 | not stated | per vulnerability databases |
| CVE-2023-42366 | medium | 5.5 | not stated | per vulnerability databases |
| CVE-2026-124742 | medium | 5.5 | not stated | per vulnerability databases |
| CVE-2026-124743 | medium | 5.5 | not stated | per vulnerability databases |
| CVE-2026-124746 | medium | 5.5 | not stated | per vulnerability databases |
| CVE-2026-88838 | medium | 5.5 | not stated | per vulnerability databases |
| CVE-2026-124738 | medium | 5.3 | not stated | per vulnerability databases |
| CVE-2026-88831 | medium | 5.3 | not stated | per vulnerability databases |
| CVE-2026-88840 | medium | 5.3 | not stated | per vulnerability databases |
| CVE-2026-38754 | medium | 5.1 | not stated | per vulnerability databases |
| CVE-2026-38753 | medium | 4.9 | not stated | per vulnerability databases |
| CVE-2026-88834 | low | 3.7 | not stated | per vulnerability databases |
| CVE-2026-88842 | low | 3.3 | not stated | per vulnerability databases |
| CVE-2026-38752 | low | 2.9 | not stated | per vulnerability databases |
| CVE-2026-38755 | low | 2.9 | not stated | per vulnerability databases |
| CVE-2024-58251 | low | 2.5 | not stated | per vulnerability databases |
| CVE-2026-76014 | low | 1.9 | not stated | per vulnerability databases |
| CVE-2026-88841 | not rated | not rated | not stated | per vulnerability databases |
What changed against BusyBox 1.37.0?
5 CVEs of 1.37.0 are no longer listed for 1.38.0: CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2025-46394, CVE-2025-60876.
No CVE was added in 1.38.0.
What does the number mean for a device?
Counted are the CVEs public sources name for BusyBox version 1.38.0 (NVD, OSV, Vendor advisories). "Confirmed by the vendor" means the CVE record or advisory comes from the vendor itself and names this version as affected. Third-party records are counted but not marked as confirmed.
Whether a CVE is exploitable in a given device depends on which functions of the library the build contains and how they are configured. The list shows what is known for the version.
Licence notes of the sources: OSV: CC BY 4.0.
Questions
How many CVEs does BusyBox 1.38.0 have?
As of 13 Nov 2026, 38 CVEs are known for BusyBox 1.38.0, 0 critical and 13 high.
From which version are the CVEs of BusyBox 1.38.0 fixed?
No newer listed version is free of all 38 CVEs. The "Fixed from" column names the fix version per CVE for this release line where a source states one.