In fmt_num() of editors/awk.c in BusyBox's awk applet, the user-controllable OFMT and CONVFMT awk variables are passed directly to snprintf() as the format string, with validation that inspects only the final character of the string to confirm it looks like a numeric conversion specifier (one of diouxXeEfFgGaA), rather than verifying the string contains exactly one conversion specifier. A crafted format string such as "%s%s%s%d" passes this check (its last character, 'd', is a valid numeric specifier) but causes snprintf() to be invoked with only a single supplied argument (the double value being formatted) while the format string itself requests multiple conversions. The extra %s conversions consume nonexistent variadic arguments, reading whatever values happen to occupy the integer-argument register save area and adjacent stack memory, and attempting to dereference them as pointers. This is triggerable either by an awk script assigning an attacker-influenced value to OFMT/CONVFMT, or via the -v OFMT=.../-v CONVFMT=... command-line option using externally-sourced data, whenever the resulting value is a non-integral double (the integral-value code path is unaffected, as it uses a fixed "%lld"/"%.0f" format). Exploitation is reliably reproducible and results in a process crash (SIGSEGV) in the common case, and can leak raw register/stack memory content (including, on non-PIE builds, potential code addresses) back through the applet's normal output when the crafted format uses %x-style conversions instead of %s. An additional attempt using a %n conversion (to obtain a write primitive) did not succeed on glibc builds with _FORTIFY_SOURCE enabled, which independently detects and rejects %n when the format string resides in writable memory (aborting with SIGABRT rather than performing a write); this mitigation is glibc-specific and was not verified against other C libraries (e.g. musl, uClibc-ng) commonly used in embedded BusyBox deployments.
CWE-134
Pending — reserved as CAN-2026-2035924 via MITRE CNA-LR on 2026-08-17, not yet assigned an actual CVE-YYYY-NNNNN number.
Artfical DT Developer Talha Berk Arslan