EUVD-2026-55623
GHSA-qpgw-rgmq-2367
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack with low-privilege shell access required; no confidentiality impact, only limited heap corruption and process abort affecting integrity and availability.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
2DescriptionCVE.org
entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string rather than the number of bytes written. When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing subsequent copies to write out of bounds. This can be triggered by supplying command-line arguments whose combined length fills the buffer, or via the /_ substitution feature which expands a short token into a longer pathname at runtime. The local attacker can cause memory corruption, process abort, and denial of service.
This issue was fixed in commit 2467fe0
AnalysisAI
Heap buffer overflow in entr's run_utility() function allows a local low-privileged user to trigger memory corruption, process abort, and denial of service by supplying crafted command-line arguments or by using the slash-underscore substitution feature, which expands a short token into a longer pathname at runtime. The flaw stems from incorrect use of strlcpy()'s return value - which reflects the total source length rather than bytes written - to advance a destination pointer, causing an unsigned size_t underflow in the remaining-buffer counter and subsequent out-of-bounds heap writes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local shell access to a system where entr is installed and the attacker can invoke it directly or influence the arguments passed to it by an automated script. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 4.8 accurately reflects the narrow blast radius: attack vector is local, privileges required are low, and impact is confined to limited integrity and availability degradation on the vulnerable system with no confidentiality exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update entr to a version that incorporates commit 2467fe0aa5f2b1b074110a9186ef51d35809c9a4 or later; this commit replaces the unsafe strlcpy-based pointer arithmetic with explicit strlen-based bounds enforcement followed by memcpy, and adds a null-pointer check on malloc. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today