CVE-2026-66485
MediumCVSS 4.6Summary
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process.
Risk Assessment
An attacker can supply a crafted archive that, when extracted by a victim, can cause the cpio process to crash, leading to denial of service.
Recommendation
Update GNU cpio to a version containing commit 3cd514031371d8aeeaf2048aa10103e02831aaa9 or later. Avoid extracting archives from untrusted sources.
Original NVD description (English source)
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9