EUVD-2026-102528
GHSA-2v49-qr2f-xxxp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted TAR archive with full ustar prefix+name
-
ExploitApplication parses it via ar_entry_get_name()
-
ExecutionOff-by-one NUL write past heap allocation in tar_get_name()
-
ImpactHeap corruption crashes process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Off-by-one prevention
|
| Exploitation Conditions | Exploitation requires an application that links unarr (through 1.1.1) and invokes the ar_entry_get_name() API on attacker-controlled TAR input; the malicious archive must contain a full ustar prefix field combined with a name field such that tar_get_name() writes a NUL byte one position past its heap allocation. Limiting factors: the attack vector is local/file-based (AV:L), not a network service, and it requires user/application interaction to open or process the crafted archive (UI:P). The impact is bounded to a single out-of-bounds NUL write causing heap corruption and a process crash (availability), with no confidentiality exposure and only minimal integrity effect, which constrains realistic outcomes to denial of service. |
| Impact | This is a medium-severity (CVSS 4.0 base 6.9) off-by-one heap buffer overflow (CWE-193) whose real-world impact is primarily denial of service rather than code execution. The input CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H) tells a consistent story: exploitation is local and file-driven (AV:L), requires no privileges (PR:N) but does require a victim to process an attacker-supplied archive (UI:P/passive), yields no confidentiality impact (VC:N), only minor integrity impact (VI:L, a single NUL byte written past the allocation), and high availability impact (VA:H, process crash). No EPSS score is provided in the input, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no explicit POC flag was provided, though a detailed third-party technical writeup exists on hackmd describing the bug - this constitutes public root-cause analysis but is not confirmed working exploit code. Net assessment: this is a legitimate but low-urgency issue - a library-level DoS requiring local archive processing, not a remotely exploitable critical flaw. The single-byte NUL overflow limits the practical path to reliable arbitrary code execution; treat as a stability/robustness fix to schedule, not an emergency patch. |
| Exploit ScenarioDerived | An attacker crafts a malicious TAR archive containing a full ustar prefix and name field combination that triggers tar_get_name() to write a NUL byte one position past its heap allocation. When a victim application built on unarr parses this archive via the ar_entry_get_name() API, the heap corruption crashes the process, causing denial of service. A public technical writeup detailing the root cause exists, but no confirmed weaponized exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
An off-by-one heap-based buffer overflow in unarr through 1.1.1 (CWE-193) lets a crafted TAR archive that carries a fully populated ustar prefix field together with a full name field trigger a single out-of-bounds NUL write in tar_get_name() when an application calls the ar_entry_get_name() API. The flaw is reachable without authentication (CVSS PR:N) but is local/file-based (CVSS 3.1 AV:L, UI:R), requiring an application that links unarr to open or process attacker-controlled archive input; the assessed impact is bounded to heap corruption and process crash (availability) with no confidentiality loss and only minor integrity effect. No public exploit identified at time of analysis, the package is not listed in CISA KEV, and no vendor-released patch has been identified.
RemediationAI
No vendor-released patch has been identified at time of analysis, so remediation is currently compensating-control based. The most direct step is to stop passing untrusted TAR input to unarr: if an application only needs RAR or ZIP support, disable or remove TAR handling entirely (trade-off: loss of TAR functionality). Where TAR support is required, pre-validate archives before they reach ar_entry_get_name() and reject entries whose ustar prefix and name fields are both fully populated or that otherwise stress the combined name buffer (trade-off: a conservative filter may reject legitimate long-path archives). Run archive parsing in a separate low-privilege, sandboxed worker process with memory limits so that heap corruption results only in a worker crash rather than taking down the host application (trade-off: added process-management complexity and latency). Building with hardened allocators or sanitizers can help detect the corruption during testing but does not prevent exploitation in production. Track the upstream repository at https://github.com/selmf/unarr for a fixed release and consult the VulnCheck advisory at https://www.vulncheck.com/advisories/unarr-through-1.1.1-off-by-one-heap-buffer-overflow-via-tar-get-name for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
unarr is a small C library for reading archive formats (RAR, ZIP, TAR) that is commonly embedded in document/comic viewers and other downstream applications. The vulnerable code lives in tar/parse-tar.c (lines 242-254 of upstream commit b211040df83dee513362cdeb9bd87afa26fd5e38), where tar_get_name() reconstructs an entry name by joining the 155-byte ustar prefix field and the 100-byte name field into a heap allocation. When both fields are fully populated, the terminating NUL byte is written one position past the end of the allocation. The root-cause class is CWE-193 (Off-by-one Error), and the reachable public entry point is ar_entry_get_name() in the ar_* abstraction layer, meaning any consumer that parses TAR input and retrieves entry names is exposed. Per the affected CPE cpe:2.3:a:selmf:unarr:*:*:*:*:*:*:*:*, all versions through 1.1.1 are in scope; because the bug is a library defect rather than a standalone service, exploitation prerequisites are dictated by the host application's handling of untrusted TAR files.
Know when Unarr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Archive is processed locally so AV:L; no privileges needed (PR:N) but a victim must open the file (UI:R); single NUL overflow gives I:L and a crash gives A:H, no confidentiality.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB