A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.
https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-06
https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html