CVE-2026-43623
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Stack-based buffer overflow vulnerability in the microtar library up to version 0.1.0. The raw_to_header() function in src/microtar.c uses strcpy() to copy name or linkname fields from a TAR archive that may lack null terminators, causing writes of up to 355 bytes into a 100-byte destination buffer.
Risk Assessment
An attacker can supply a crafted TAR archive, potentially corrupting adjacent stack memory and possibly leading to arbitrary code execution.
Recommendation
Update the microtar library to a version later than 0.1.0 or apply a security patch.
Other vulnerabilities in microtar
See all- CVE-2026-71267Critical
microtar's mtar_write_file_header and mtar_write_dir_header functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy.
- CVE-2026-55738High
Stack-based buffer overflow in raw_to_header function in src/microtar.c in microtar 0.1.0. The function copies name and linkname fields using strcpy without ensuring null termination.
- CVE-2026-54417High
An integer overflow in the mtar_next function in microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. The offset calculation uses 32-bit arithmetic.
Original NVD description (English source)
microtar through 0.1.0 contains a stack-based buffer overflow vulnerability in the raw_to_header() function in src/microtar.c that allows attackers to corrupt adjacent stack memory by supplying a crafted TAR archive with non-null-terminated name or linkname fields. The function uses strcpy() to copy 100-byte ustar format fields that lack null terminators, causing writes of up to 355 bytes into a 100-byte destination buffer when mtar_open(), mtar_find(), or mtar_read_header() process attacker-supplied TAR archives.