microtar
CVE-2026-55738
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft TAR archive with null-terminator-free linkname field
-
DeliveryDeliver archive to victim via upload, email, or shared storage
-
ExploitVictim app invokes mtar_open() or mtar_read_header()
-
Executionstrcpy() reads past end of 512-byte raw header buffer
-
PersistStack buffer overflow corrupts adjacent stack frames
-
ImpactCrash (DoS) or hijack of return address for code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target application must embed and call rxi microtar specifically - this vulnerability does not affect libarchive, zlib, or other TAR implementations. The application must invoke mtar_open(), mtar_read_header(), or mtar_find() on attacker-supplied input. The triggering condition is a TAR archive whose name or linkname field is fully populated across all 100 bytes without a null terminator - a condition permitted by the POSIX ustar standard but not produced by standard tools such as GNU tar. User interaction is required (CVSS UI:P): a person or automated process must open or trigger parsing of the crafted archive. No authentication is required from the attacker's perspective (PR:N). Factors limiting exploitation include: (1) the target must embed microtar rather than a more common TAR library; (2) the application must accept archives from untrusted sources; (3) SSVC automatable: no indicates mass exploitation without victim interaction is not feasible; and (4) reliable code execution beyond a crash may require knowledge of the target's stack layout. |
| Impact | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) reflects a network-reachable attack surface and high potential impact, but several moderating signals constrain real-world risk. EPSS at 0.64% (46th percentile) is notably low, indicating the security community does not anticipate near-term widespread exploitation. SSVC classifies exploitation as 'none' and automatable as 'no' - directly consistent with the UI:P requirement that a victim must actively trigger archive parsing. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified. However, SSVC's technical impact of 'total' and the AddressSanitizer confirmation of a clean, reproducible stack overflow make this a credible RCE primitive for targeted attacks; even a mid-sized municipal IT team in walbrzych operating a build pipeline or file-processing service that ingests user-supplied TAR archives should treat this as a priority patch item given the absence of upstream remediation. The library appears to be minimally maintained, making a timely upstream fix unlikely, and CVSS vector and SSVC signals are consistent with each other - there are no contradictions in the available data, though affected version bounds beyond '0.1.0' are unconfirmed. |
| Exploit ScenarioDerived | An attacker crafts a TAR archive in which the linkname field is fully populated with 100 non-null bytes, with no null terminator present within the archive's 512-byte header block. When a victim application built on microtar - such as a CI/CD build tool, backup client, or file manager - calls mtar_find() or mtar_read_header() on this archive, strcpy() in raw_to_header() overshoots the raw buffer, corrupts adjacent stack memory, and can overwrite a return address to redirect execution. No public proof-of-concept exploit has been identified, but the AddressSanitizer output cited in the CVE description provides sufficient detail to reconstruct one. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 10, 2026
Stack-based buffer overflow in rxi microtar 0.1.0's raw_to_header() function allows a remote attacker to cause denial of service and potentially execute arbitrary code by supplying a crafted TAR archive containing name or linkname fields that fully occupy their 100-byte POSIX ustar slots without a null terminator. Exploitation requires victim interaction - a user or automated process must open or parse the malicious archive via mtar_open(), mtar_read_header(), or mtar_find(). No patch has been identified at time of analysis, no public exploit code exists, and no CISA KEV listing is present, though the vulnerability is confirmed by AddressSanitizer output showing a stack-buffer-overflow READ of size 356 at src/microtar.c:112.
Earlier versions of this analysis (1)
Stack-based buffer overflow in rxi microtar 0.1.0 allows remote attackers to crash or potentially execute arbitrary code in applications that parse attacker-supplied TAR archives. The flaw lies in raw_to_header() (src/microtar.c:112), which uses strcpy() on fixed-width 100-byte ustar name/linkname fields that are not guaranteed to be null-terminated, enabling a 356-byte out-of-bounds read confirmed via AddressSanitizer. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch has been identified at time of analysis for rxi microtar. Developers integrating microtar should apply a local source-level fix by replacing the strcpy() calls in raw_to_header() with strncpy() paired with explicit null termination - for example, strncpy(h->name, raw->name, 100); h->name[100] = '\0'; - which prevents reads and writes from exceeding field boundaries regardless of null terminator absence. As a compensating control, applications should validate or reject TAR archives originating from untrusted sources before invoking mtar_open(), mtar_read_header(), or mtar_find(); this eliminates the vulnerable code path but may disrupt legitimate processing workflows and requires robust allowlisting of trusted archive sources. If microtar is invoked through a network-facing upload or processing endpoint, restricting that endpoint to authenticated, trusted users reduces the realistic attack surface at the cost of reduced functionality for anonymous users. The upstream repository is at https://github.com/rxi/microtar - monitor for future commits addressing this issue.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
rxi microtar (CPE: cpe:2.3:a:rxi:microtar:*:*:*:*:*:*:*:*) is a lightweight, single-file C library for reading and writing TAR archives. The root cause (CWE-121: Stack-based Buffer Overflow) lies in raw_to_header() at src/microtar.c:112, where strcpy() copies the 100-byte 'name' and 'linkname' fields from a 512-byte stack-allocated raw TAR header buffer into a destination mtar_header_t struct. The POSIX ustar specification explicitly permits these fixed-width fields to be fully populated without a null terminator, meaning a standards-compliant but adversarially crafted archive can provide a linkname field with no embedded null byte within the 512-byte block. Because strcpy() scans until it finds a null byte, it reads past the end of the 512-byte raw buffer (out-of-bounds read) and then writes past the destination buffer on the stack (stack buffer overflow), corrupting adjacent stack frames. The specific code path at issue is accessible at https://github.com/rxi/microtar/blob/master/src/microtar.c#L111.
Know when Microtar gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-delivered archive requires victim to open it (UI:R, PR:N); full stack corruption yields complete C/I/A impact with no scope change.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
A stack-based buffer overflow exists in the raw_to_header() function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy() without guaranteeing null termination of the source. The POSIX ustar format permits these fixed-width fields to be fully populated with non-null bytes, so a crafted archive whose linkname field (followed by the trailing padding of the 512-byte raw header) contains no null terminator causes strcpy() to read past the end of the 512-byte raw header stack buffer and to write past the destination header buffer. A remote attacker who supplies a crafted TAR archive that the victim opens or parses (via mtar_open(), mtar_read_header(), or mtar_find()) can cause an out-of-bounds read and a stack buffer overflow, resulting in denial of service (crash) and potentially arbitrary code execution. Confirmed with AddressSanitizer: stack-buffer-overflow READ of size 356 in raw_to_header at src/microtar.c:112.
Executive ViewAI
A critical vulnerability in rxi microtar 0.1.0 enables remote attackers to disrupt operations or potentially gain unauthorized system access by sending crafted TAR archives that are processed by your applications. Any organization using this library for archive handling-including in automated workflows-faces immediate risk. Swift action to identify affected systems and restrict untrusted archive processing is essential to prevent service disruption or data compromise.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) restrict TAR archive processing to verified internal sources only, blocking external or user-supplied archives; (2) implement strict input validation on archive structure before processing via mtar_open() or mtar_read_header(), rejecting any TAR files with malformed name/linkname fields; (3) run microtar parsing operations in isolated processes with restricted privileges, memory limits, and resource quotas to contain potential exploitation; (4) deploy behavior-based monitoring for unexpected crashes or memory access violations originating from archive processing. Prioritize migration to actively maintained TAR libraries as the long-term solution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Stack-based buffer overflow in microtar through 0.1.0 allows remote attackers to corrupt stack memory and potentially ac
Stack buffer overflow in rxi's microtar C library allows memory corruption when an application archives files with attac
Denial of service through infinite CPU consumption affects rxi microtar 0.1.0, a lightweight C library for tar archive p
Exploit-DB