microtar
CVE-2026-55738
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered archive requires victim to open it (UI:R, PR:N); full stack corruption yields complete C/I/A impact with no scope change.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
4DescriptionCVE.org
A stack-based buffer overflow exists in the raw_to_header() function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy() without guaranteeing null termination of the source. The POSIX ustar format permits these fixed-width fields to be fully populated with non-null bytes, so a crafted archive whose linkname field (followed by the trailing padding of the 512-byte raw header) contains no null terminator causes strcpy() to read past the end of the 512-byte raw header stack buffer and to write past the destination header buffer. A remote attacker who supplies a crafted TAR archive that the victim opens or parses (via mtar_open(), mtar_read_header(), or mtar_find()) can cause an out-of-bounds read and a stack buffer overflow, resulting in denial of service (crash) and potentially arbitrary code execution. Confirmed with AddressSanitizer: stack-buffer-overflow READ of size 356 in raw_to_header at src/microtar.c:112.
AnalysisAI
Stack-based buffer overflow in rxi microtar 0.1.0's raw_to_header() function allows a remote attacker to cause denial of service and potentially execute arbitrary code by supplying a crafted TAR archive containing name or linkname fields that fully occupy their 100-byte POSIX ustar slots without a null terminator. Exploitation requires victim interaction - a user or automated process must open or parse the malicious archive via mtar_open(), mtar_read_header(), or mtar_find(). No patch has been identified at time of analysis, no public exploit code exists, and no CISA KEV listing is present, though the vulnerability is confirmed by AddressSanitizer output showing a stack-buffer-overflow READ of size 356 at src/microtar.c:112.
Technical ContextAI
rxi microtar (CPE: cpe:2.3:a:rxi:microtar:*:*:*:*:*:*:*:*) is a lightweight, single-file C library for reading and writing TAR archives. The root cause (CWE-121: Stack-based Buffer Overflow) lies in raw_to_header() at src/microtar.c:112, where strcpy() copies the 100-byte 'name' and 'linkname' fields from a 512-byte stack-allocated raw TAR header buffer into a destination mtar_header_t struct. The POSIX ustar specification explicitly permits these fixed-width fields to be fully populated without a null terminator, meaning a standards-compliant but adversarially crafted archive can provide a linkname field with no embedded null byte within the 512-byte block. Because strcpy() scans until it finds a null byte, it reads past the end of the 512-byte raw buffer (out-of-bounds read) and then writes past the destination buffer on the stack (stack buffer overflow), corrupting adjacent stack frames. The specific code path at issue is accessible at https://github.com/rxi/microtar/blob/master/src/microtar.c#L111.
RemediationAI
No vendor-released patch has been identified at time of analysis for rxi microtar. Developers integrating microtar should apply a local source-level fix by replacing the strcpy() calls in raw_to_header() with strncpy() paired with explicit null termination - for example, strncpy(h->name, raw->name, 100); h->name[100] = '\0'; - which prevents reads and writes from exceeding field boundaries regardless of null terminator absence. As a compensating control, applications should validate or reject TAR archives originating from untrusted sources before invoking mtar_open(), mtar_read_header(), or mtar_find(); this eliminates the vulnerable code path but may disrupt legitimate processing workflows and requires robust allowlisting of trusted archive sources. If microtar is invoked through a network-facing upload or processing endpoint, restricting that endpoint to authenticated, trusted users reduces the realistic attack surface at the cost of reduced functionality for anonymous users. The upstream repository is at https://github.com/rxi/microtar - monitor for future commits addressing this issue.
Stack-based buffer overflow in microtar through 0.1.0 allows remote attackers to corrupt stack memory and potentially ac
Stack buffer overflow in rxi's microtar C library allows memory corruption when an application archives files with attac
Denial of service through infinite CPU consumption affects rxi microtar 0.1.0, a lightweight C library for tar archive p
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today