CVE-2026-71267
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
microtar's mtar_write_file_header and mtar_write_dir_header functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy.
Risk Assessment
An attacker can supply a long entry name, causing a buffer overflow, leading to program crash or potentially remote code execution.
Recommendation
Update microtar to the latest version. Also use safe copy functions with length limits.
Other vulnerabilities in microtar
See all- CVE-2026-55738High
Stack-based buffer overflow in raw_to_header function in src/microtar.c in microtar 0.1.0. The function copies name and linkname fields using strcpy without ensuring null termination.
- CVE-2026-54417High
An integer overflow in the mtar_next function in microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. The offset calculation uses 32-bit arithmetic.
- CVE-2026-43623High
Stack-based buffer overflow vulnerability in the microtar library up to version 0.1.0. The raw_to_header() function in src/microtar.c uses strcpy() to copy name or linkname fields from a TAR archive that may lack null terminators, causing writes of up to 355 bytes into a 100-byte destination buffer.
Original NVD description (English source)
microtar's mtar_write_file_header and mtar_write_dir_header functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy.