BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4798-1 advisory.

    - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication     heap buffer       overflow when processing a crafted `ClientKeyExchange` message (bsc#1282575).
    - CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths     (bsc#1282550).
    - CVE-2026-88832: romfs volume ID parsing uses unbounded `strlen` on attacker-controlled metadata and     allows for a heap       buffer overflow when crafted filesystem images are processed (bsc#1282576).
    - CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on     malformed .deb       packages (bsc#1282551).
    - CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
    - CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint     (bsc#1282568).
    - CVE-2026-88841: OOB read and silent memory corruption of the status file due to `write_status_file()`     failing to reset       the `field_start` cursor between package stanzas (bsc#1282653).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4760-1 advisory.

    - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication     heap buffer       overflow when processing a crafted `ClientKeyExchange` message (bsc#1282575).
    - CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths     (bsc#1282550).
    - CVE-2026-88832: romfs volume ID parsing uses unbounded `strlen` on attacker-controlled metadata and     allows for a heap       buffer overflow when crafted filesystem images are processed (bsc#1282576).
    - CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on     malformed .deb       packages (bsc#1282551).
    - CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
    - CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint     (bsc#1282568).
    - CVE-2026-88841: OOB read and silent memory corruption of the status file due to `write_status_file()`     failing to reset       the `field_start` cursor between package stanzas (bsc#1282653).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4773-1 advisory.

    - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication     heap buffer       overflow when processing a crafted `ClientKeyExchange` message (bsc#1282575).
    - CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths     (bsc#1282550).
    - CVE-2026-88832: romfs volume ID parsing uses unbounded `strlen` on attacker-controlled metadata and     allows for a heap       buffer overflow when crafted filesystem images are processed (bsc#1282576).
    - CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on     malformed .deb       packages (bsc#1282551).
    - CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
    - CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint     (bsc#1282568).
    - CVE-2026-88841: OOB read and silent memory corruption of the status file due to `write_status_file()`     failing to reset       the `field_start` cursor between package stanzas (bsc#1282653).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap     buffer overflow when processing crafted filesystem images. (CVE-2026-88832)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
370408	SUSE SLES15 Security Update : busybox (SUSE-SU-2026:4798-1)	Nessus	SuSE Local Security Checks	Local	high
370372	SUSE SLED15 / SLES15 Security Update : busybox (SUSE-SU-2026:4760-1)	Nessus	SuSE Local Security Checks	Local	high
370370	SUSE SLES12 Security Update : busybox (SUSE-SU-2026:4773-1)	Nessus	SuSE Local Security Checks	Local	high
350224	Linux Distros Unpatched Vulnerability : CVE-2026-88832	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-88832

high

Tenable Plugins

high

high

high

high