CVE-2026-54417
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
An integer overflow in the mtar_next function in microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. The offset calculation uses 32-bit arithmetic.
Risk Assessment
An attacker can cause service unavailability by sending a specially crafted tar file, leading to system overload.
Recommendation
Update the microtar library to a patched version or apply mitigations to limit processing of untrusted tar archives.
Other vulnerabilities in microtar
See all- CVE-2026-71267Critical
microtar's mtar_write_file_header and mtar_write_dir_header functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy.
- CVE-2026-55738High
Stack-based buffer overflow in raw_to_header function in src/microtar.c in microtar 0.1.0. The function copies name and linkname fields using strcpy without ensuring null termination.
- CVE-2026-43623High
Stack-based buffer overflow vulnerability in the microtar library up to version 0.1.0. The raw_to_header() function in src/microtar.c uses strcpy() to copy name or linkname fields from a TAR archive that may lack null terminators, causing writes of up to 355 bytes into a 100-byte destination buffer.
Original NVD description (English source)
An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. mtar_next computes the offset to the next record as round_up(h.size, 512) + sizeof(mtar_raw_header_t) using 32-bit arithmetic.