CVE-2026-55738
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Stack-based buffer overflow in raw_to_header function in src/microtar.c in microtar 0.1.0. The function copies name and linkname fields using strcpy without ensuring null termination.
Risk Assessment
Risk of arbitrary code execution or program crash when processing malicious TAR files.
Recommendation
Update microtar to a patched version or avoid processing untrusted TAR files.
Other vulnerabilities in microtar
See all- CVE-2026-71267Critical
microtar's mtar_write_file_header and mtar_write_dir_header functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy.
- CVE-2026-54417High
An integer overflow in the mtar_next function in microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. The offset calculation uses 32-bit arithmetic.
- CVE-2026-43623High
Stack-based buffer overflow vulnerability in the microtar library up to version 0.1.0. The raw_to_header() function in src/microtar.c uses strcpy() to copy name or linkname fields from a TAR archive that may lack null terminators, causing writes of up to 355 bytes into a 100-byte destination buffer.
Original NVD description (English source)
A stack-based buffer overflow exists in the raw_to_header function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy without guaranteeing null termination of the source.