Which versions of microtar are affected by CVE-2026-43623?

microtar library (versions through 0.1.0) contains a remote code execution vulnerability in TAR archive parsing that enables attackers to execute arbitrary code by submitting malicious files.

Is there a public PoC exploit available for CVE-2026-43623?

Yes, a public proof-of-concept exploit is available for CVE-2026-43623. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-43623?

Within 24 hours: Inventory all applications and services using microtar; isolate affected systems from sensitive networks and external file inputs. Within 7 days: Implement strict input validation (reject oversized TAR files, disable hard links/symlinks, verify file origins); evaluate migration to patched alternatives (libtar, libbsdtar, bsdtar). Within 30 days: Execute migration plan away from microtar or establish permanent compensating controls; establish process to immediately apply vendor patch upon release.

microtar CVE-2026-43623

Q: What is the CVSS score of CVE-2026-43623?

CVE-2026-43623 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33741 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-01 VulnCheck

GHSA-mwwm-v74q-mvh9

Buffer Overflow Stack Overflow Microtar

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 19:25 vuln.today

CVSS changed

Jun 01, 2026 - 19:22 NVD

8.8 (HIGH) 8.7 (HIGH)

DescriptionCVE.org

microtar through 0.1.0 contains a stack-based buffer overflow vulnerability in the raw_to_header() function in src/microtar.c that allows attackers to corrupt adjacent stack memory by supplying a crafted TAR archive with non-null-terminated name or linkname fields. The function uses strcpy() to copy 100-byte ustar format fields that lack null terminators, causing writes of up to 355 bytes into a 100-byte destination buffer when mtar_open(), mtar_find(), or mtar_read_header() process attacker-supplied TAR archives.

AnalysisAI

Stack-based buffer overflow in microtar through 0.1.0 allows remote attackers to corrupt stack memory and potentially achieve code execution when an application using the library parses a malicious TAR archive. The flaw in raw_to_header() uses strcpy() on non-null-terminated 100-byte ustar fields, enabling writes of up to 355 bytes into a 100-byte buffer. Publicly available exploit code exists and the issue was reported by VulnCheck, raising the practical risk despite no current CISA KEV listing.

Technical ContextAI

microtar is a small single-file C library by rxi (cpe:2.3:a:rxi:microtar) used by embedded systems, games, and tooling to read and write TAR archives. The bug is a textbook CWE-121 stack-based buffer overflow: the ustar header format reserves fixed 100-byte fields for name and linkname that are NOT required to be null-terminated when fully populated, yet raw_to_header() copies them with strcpy(), which only stops at a null byte. A crafted header that omits terminators causes strcpy to continue reading across adjacent header fields (up to ~355 bytes), overwriting return addresses and saved registers on the call stack of any caller of mtar_open(), mtar_find(), or mtar_read_header().

RemediationAI

No vendor-released patch identified at time of analysis - upstream issues #28, #29, and #30 at https://github.com/rxi/microtar/issues track the report but no tagged release beyond 0.1.0 is referenced in the provided data; monitor the repository for a fixed release. As compensating controls, downstream maintainers should patch their vendored copy of src/microtar.c by replacing the strcpy() calls in raw_to_header() with bounded copies (memcpy of 100 bytes followed by explicit null termination, or strnlen-validated copies) - this is a minimal change with no functional side effect. Applications that accept TAR archives from untrusted sources should additionally validate that name and linkname fields contain a null terminator within the first 100 bytes before invoking mtar_open(), mtar_find(), or mtar_read_header(), and treat untrusted archive parsing as a privilege boundary by sandboxing the process (seccomp, separate UID, or a parser subprocess), accepting the trade-off of slightly higher complexity in archive handling pipelines. Consult the VulnCheck advisory for further detail.