decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.
Exploitability
AC:LAV:NPR:NUI:NScope
S:UImpact
A:HC:NI:N7.5/CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N