🟡 Medium  |  Source: Microsoft Security Response Center


A use-after-free vulnerability in BusyBox v1.38.0 allows an attacker to crash affected systems by supplying a specially crafted AWK script, resulting in a Denial of Service. BusyBox is a widely used lightweight Unix toolset commonly found in Linux-based container images and embedded systems. This vulnerability is relevant to Azure and cloud workloads that run containers built on minimal Linux distributions incorporating BusyBox.

Security Architect’s Take: Audit your container base images and any Azure-hosted workloads for BusyBox v1.38.0 and upgrade to a patched version promptly; also review your container image scanning pipeline to ensure vulnerable BusyBox versions are flagged before deployment.

Original advisory: CVE-2026-38753 A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.