Skip to main content

GNU cpio CVE-2026-66485

| EUVDEUVD-2026-55255 MEDIUM
Memory Allocation with Excessive Size Value (CWE-789)
2026-08-10 CERT-PL GHSA-mmw4-f4p6-w77q
Denial Of Service Cpio Gnu
4.6
CVSS 4.0 · Vendor: CERT-PL
Share

Severity by source

Vendor (CERT-PL) PRIMARY
4.6 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.3 LOW

Local delivery of crafted archive requires user-triggered extraction (UI:R); no attacker privileges needed; impact is solely a process crash with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.0 MEDIUM
AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Red Hat
5.0 MEDIUM
qualitative

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 10, 2026 - 11:07 vuln.today

DescriptionCVE.org

GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.

This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9

AnalysisAI

Stack overflow in GNU cpio's make_path function (src/makepath.c) causes a denial of service when a victim extracts a crafted archive. The function uses alloca() to allocate stack memory sized by an attacker-controlled pathname embedded in the archive, allowing unbounded stack growth and a process crash with no confidentiality or integrity impact. No active exploitation or public proof-of-concept has been identified at time of analysis; the upstream fix is available as a single commit.

Technical ContextAI

GNU cpio (CPE: cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*) is a POSIX archive utility widely included in Linux distributions. The vulnerable code path is make_path() in src/makepath.c, which uses alloca() - a C runtime function that allocates memory directly on the current stack frame. Unlike malloc(), alloca() does not return a failure indicator; on most architectures it simply moves the stack pointer, making it inherently unsafe when the size argument is unbounded. The size is derived from argpath, which is taken directly from a pathname within the cpio archive being extracted. A maliciously crafted archive can therefore supply a pathname of arbitrary length, triggering uncontrolled stack growth. CWE-789 (Uncontrolled Memory Allocation) precisely describes this root cause: memory allocation whose upper bound is dictated by attacker-supplied input without an imposed ceiling.

RemediationAI

The upstream fix is commit 3cd514031371d8aeeaf2048aa10103e02831aaa9 in the GNU cpio repository (https://git.savannah.gnu.org/cgit/cpio.git); a versioned patched release has not been independently confirmed, so users should monitor their OS distribution's package tracker for an updated cpio package that incorporates this commit. As a compensating control for automated pipelines, validate or reject cpio archives whose embedded pathnames exceed a safe length threshold before invoking cpio extraction; alternatively, run cpio within a process with a restricted stack size limit (ulimit -s) to cause an early controlled failure rather than an unbounded overflow. The CERT-PL advisory at https://cert.pl/en/posts/2026/08/CVE-2026-66484 provides additional context. Enforcing a strict ulimit on cpio processes has the trade-off of potentially rejecting legitimate archives with very long but valid paths.

More in Cpio

View all
CVE-2021-38185 HIGH POC
7.8 Aug 08

GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_f
CVE-2016-2037 MEDIUM
6.5 Feb 22

The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-
CVE-2014-9112 MEDIUM POC
5.0 Dec 02

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of
CVE-2015-1197 LOW POC
1.9 Feb 19

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink a
CVE-2026-66484 MEDIUM
4.6 Aug 10

Hard-link path traversal in GNU cpio's tar extraction mode enables an attacker-controlled archive to create hard links p
CVE-2026-66486 MEDIUM
4.6 Aug 10

Terminal escape sequence injection and output spoofing in GNU cpio's archive-listing mode (`cpio -it`) allows an attacke

Same weakness CWE-789 – Memory Allocation with Excessive Size Value

View all
CVE-2026-59204 HIGH POC
8.7
CVE-2018-25368 HIGH POC
8.7
CVE-2021-47973 HIGH POC
8.7
CVE-2021-47972 HIGH POC
8.7
CVE-2021-47971 HIGH POC
8.7
CVE-2021-47970 HIGH POC
8.7
CVE-2021-47969 HIGH POC
8.7
CVE-2021-47944 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-66485 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy