CVE-2026-111273

MediumCVSS 6.1

Published: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.

Risk Assessment

The vulnerability allows remote heap memory corruption and crashes of applications processing TAR archives, potentially leading to denial of service or code execution.

Recommendation

Upgrade unarr beyond version 1.1.1 and fix the buffer boundary check in tar_get_name().

Other vulnerabilities in unarr

CVE-2026-111274Medium
unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS