GNU tar CVE-2026-18477

Exploitation requires three concurrent conditions to be satisfied simultaneously. First, the attacker must hold a low-privileged local account with write access to at least one directory that is included in an active incremental tar backup set using the dumpdir 'X' rename tracking feature - this means the backup must be run with --listed-incremental or equivalent. Second, the attacker must have access to the specific system where the restore is performed, which may be the same host or a separate restore target. Third, the restore operation must be initiated by a privileged user or automated process (UI:R), since the attacker cannot trigger the restore independently. The race window is narrow and timing-dependent (AC:H), requiring the attacker to swap in a symlink or manipulate a path entry between tar's check and use. The CVE description explicitly rules out the -P omission and new-directory extraction as mitigations, limiting defenders' options without patching. Exploitation is limited to incremental backup workflows - standard non-incremental tar archive extraction is not affected.

The CVSS 3.1 score of 4.4 (Medium) with vector AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N accurately captures the multi-prerequisite nature of this attack. The high attack complexity (AC:H) reflects a genuine race condition with a narrow timing window. PR:L confirms the attacker needs an existing low-privileged account and write access to a directory in the backup set. UI:R is a meaningful gate - exploitation cannot proceed without a separate user (typically an administrator) actively performing a restore. No EPSS score was provided in the input, and the CVE is not in CISA KEV, so exploitation probability in the wild is unquantified but presumed low given the complexity. The I:H rating is warranted because successful exploitation allows writing files to arbitrary paths, which on Linux can chain into privilege escalation (e.g., overwriting a setuid binary or cron job). The absence of confidentiality or availability impact keeps the overall severity realistic. This is a genuine but operationally constrained risk - highest on multi-tenant systems where untrusted users share backed-up directories with privileged restore workflows.

A low-privileged user on a shared RHEL server has write access to a home directory or shared folder that an administrator backs up nightly using GNU tar's incremental mode. The attacker pre-stages a directory rename sequence in the dumpdir-tracked path, then waits for the administrator to perform a restore; during the brief window between tar's rename check and execution, the attacker replaces the rename target with a symlink pointing to /etc/cron.d, causing tar to write a controlled file into the cron directory and achieving code execution as root at the next cron cycle.