GNU cpio CVE-2026-66486

Exploitation requires that the victim actively invoke cpio -it (or equivalent listing mode) on an attacker-controlled cpio archive within a terminal session. The CVSS 4.0 vector confirms local attack vector (AV:L) with active user interaction (UI:A): the victim must deliberately execute the list command against the crafted archive - exploitation cannot be triggered remotely or without the victim's direct action. No authentication or special system privileges are required to craft or deliver the archive (PR:N). Visual terminal manipulation impact is further conditional on the victim using a terminal emulator that renders ANSI escape sequences (most modern emulators do). Limiting factors include: the attacker must successfully deliver the crafted archive to the target (social engineering or supply-chain access required); the victim must choose to list rather than simply extract; and programmatic consumers of cpio -it output may be affected differently (newline injection causing parsing errors or log spoofing rather than visual deception). There is no network-accessible attack surface - this is not exploitable against default-configured systems without user participation.

The CVSS 4.0 score of 4.6 (Medium) accurately captures the constrained real-world risk: local attack vector (AV:L) combined with mandatory active user interaction (UI:A) sharply limits opportunistic exploitation, and the only confirmed impact is low integrity (VI:L) via display deception - there is no confidentiality or availability impact. No EPSS score was supplied in the input data, so exploitation probability cannot be quantified precisely; however, the interaction requirement makes mass automated exploitation implausible. The CVE is not in the CISA KEV catalog and no public proof-of-concept has been identified, making this a low-urgency patching item for most organizations. That said, even a mid-sized municipal IT team in olsztyn that runs automated backup or archival pipelines where cpio -it output is parsed by scripts or reviewed in terminal-based log aggregators should treat this as worth scheduling, since a newline injection could spoof log entries or deceive an operator inspecting archive contents before extraction. The primary realistic threat is a social-engineering or supply-chain scenario where a victim is tricked into listing a malicious archive, not a remotely triggerable, unauthenticated attack path.

An attacker crafts a cpio archive containing filenames with embedded ANSI escape sequences or newline characters and delivers it to a target - for example, as a software package, backup file, or email attachment - and persuades the recipient to run cpio -it to preview its contents. When the listing command executes, injected escape sequences manipulate the terminal display to hide actual malicious filenames or insert convincing fake entries, deceiving the operator into believing the archive is benign before extraction. No public proof-of-concept exploit has been identified, but crafting such an archive requires only standard cpio tooling and knowledge of ANSI escape code syntax.