EUVD-2026-53352
GHSA-3h9h-4m9g-9m4r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Kept network vector since attacker-controlled names may arrive remotely, but raised to AC:H because exploitation depends on a reachable call site and defeating stack protections; full C/I/A impact reflects potential code execution.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
microtar's mtar_write_file_header() and mtar_write_dir_header() functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte name field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy. Any application that calls these functions with an externally-influenced filename longer than 99 characters (e.g. when archiving user-supplied or attacker-controlled filenames) triggers a stack buffer overflow.
AnalysisAI
Stack buffer overflow in rxi's microtar C library allows memory corruption when an application archives files with attacker-influenced names longer than 99 characters. The mtar_write_file_header() and mtar_write_dir_header() functions use an unbounded strcpy() into a fixed 100-byte stack buffer, so any calling program that feeds externally-controlled filenames into these APIs is exposed to potential code execution or crash. No public exploit identified at time of analysis, and the library is not listed in CISA KEV, but the missing length check is trivially reachable in code that tars user-supplied paths.
Technical ContextAI
microtar is a minimal single-file tar archive library written in C (src/microtar.c) by developer rxi, commonly embedded in other projects for reading and writing tar streams. The mtar_header_t structure defines a fixed 100-byte name field mirroring the POSIX/ustar tar header name field. The vulnerable code path performs strcpy(h.name, name) with no prior strlen() bounds check, so a name of 100 or more bytes overruns the stack-allocated header structure. This is a textbook CWE-121 (Stack-based Buffer Overflow) caused by use of an unbounded string copy on a caller-supplied input, a root-cause class that classic tar tooling avoids by truncating or splitting long names into the prefix field.
RemediationAI
No vendor-released patch identified at time of analysis; the only references are the upstream repository (https://github.com/rxi/microtar) and source file, with no tagged fixed release. As an immediate code-level fix, integrators should patch mtar_write_file_header() and mtar_write_dir_header() to reject or truncate names where strlen(name) >= 100 (for example replace strcpy with a bounded copy such as snprintf(h.name, sizeof(h.name), "%s", name) or an explicit length guard that returns an error like MTAR_EWRITEFAIL). Until an upstream fix is available, callers should validate and cap filename length to 99 bytes before passing values into these functions, and sanitize any user- or network-sourced paths at the application boundary; the trade-off is that legitimately long names will be rejected or truncated, so archive fidelity for such entries is lost. Compiling the embedding application with stack canaries (-fstack-protector-strong), FORTIFY_SOURCE, ASLR, and non-executable stacks reduces the chance a triggered overflow becomes code execution rather than a crash.
Stack-based buffer overflow in microtar through 0.1.0 allows remote attackers to corrupt stack memory and potentially ac
Stack-based buffer overflow in rxi microtar 0.1.0's raw_to_header() function allows a remote attacker to cause denial of
Denial of service through infinite CPU consumption affects rxi microtar 0.1.0, a lightweight C library for tar archive p
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today