EUVD-2026-33741
GHSA-mwwm-v74q-mvh9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft TAR with unterminated name field
-
DeliveryDeliver archive to victim application
-
ExploitVictim opens or unpacks archive
-
Installstrcpy overflows stack buffer in raw_to_header
-
C2Overwrite saved return address
-
ExecuteHijack control flow
-
ImpactExecute attacker code in host process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to invoke microtar's mtar_open(), mtar_find(), or mtar_read_header() on an attacker-supplied TAR archive whose ustar name or linkname fields are fully populated to 100 bytes WITHOUT a trailing null byte - the exact precondition documented in the CVE. The CVSS vector specifies UI:P (passive user interaction), meaning the victim must perform a normal action such as opening, importing, or unpacking the archive; no authentication is required (PR:N). Practical limiting factors: the target must be built against vulnerable microtar through 0.1.0, the archive must reach a microtar entry point (so applications that pre-validate headers or use a different TAR parser are not vulnerable), and successful code execution further depends on the target platform's stack protections (canaries, ASLR, NX) since this is a classic stack overflow rather than a logic flaw. |
| Impact | CVSS 4.0 scores this 8.7 with AV:N/AC:L/PR:N/UI:P and high confidentiality, integrity, and availability impact - meaning remote unauthenticated exploitation is possible but requires a user to feed the malicious archive to a microtar-based application (passive UI). Publicly available exploit code exists (referenced VulnCheck advisory and GitHub issue #28), elevating real-world risk, but the vulnerability is not in CISA KEV and no EPSS score was provided in the input, so widespread automated exploitation is not confirmed. The realistic priority depends heavily on downstream consumers: microtar is embedded into other software, so risk concentrates wherever an application accepts attacker-controlled TAR input. CVSS shows network attack vector, but the practical delivery model is file-based (archive supplied to a microtar caller), which defenders should weigh - the network vector is satisfied by any flow that delivers an archive (web upload, update package, asset fetch). |
| Exploit ScenarioDerived | An attacker hosts or delivers a crafted TAR archive whose ustar name or linkname field is fully populated to 100 bytes without a trailing null. When a victim application built on microtar opens the archive - for example, a game loader fetching asset packs, an installer processing an update bundle, or a backend service unpacking a user upload - strcpy() in raw_to_header() overwrites the return address on the stack, allowing the attacker to redirect execution. Publicly available exploit code referenced from GitHub issue #28 lowers the barrier to weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 01, 2026
Stack-based buffer overflow in microtar through 0.1.0 allows remote attackers to corrupt stack memory and potentially achieve code execution when an application using the library parses a malicious TAR archive. The flaw in raw_to_header() uses strcpy() on non-null-terminated 100-byte ustar fields, enabling writes of up to 355 bytes into a 100-byte buffer. Publicly available exploit code exists and the issue was reported by VulnCheck, raising the practical risk despite no current CISA KEV listing.
RemediationAI
No vendor-released patch identified at time of analysis - upstream issues #28, #29, and #30 at https://github.com/rxi/microtar/issues track the report but no tagged release beyond 0.1.0 is referenced in the provided data; monitor the repository for a fixed release. As compensating controls, downstream maintainers should patch their vendored copy of src/microtar.c by replacing the strcpy() calls in raw_to_header() with bounded copies (memcpy of 100 bytes followed by explicit null termination, or strnlen-validated copies) - this is a minimal change with no functional side effect. Applications that accept TAR archives from untrusted sources should additionally validate that name and linkname fields contain a null terminator within the first 100 bytes before invoking mtar_open(), mtar_find(), or mtar_read_header(), and treat untrusted archive parsing as a privilege boundary by sandboxing the process (seccomp, separate UID, or a parser subprocess), accepting the trade-off of slightly higher complexity in archive handling pipelines. Consult the VulnCheck advisory for further detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
microtar is a small single-file C library by rxi (cpe:2.3:a:rxi:microtar) used by embedded systems, games, and tooling to read and write TAR archives. The bug is a textbook CWE-121 stack-based buffer overflow: the ustar header format reserves fixed 100-byte fields for name and linkname that are NOT required to be null-terminated when fully populated, yet raw_to_header() copies them with strcpy(), which only stops at a null byte. A crafted header that omits terminators causes strcpy to continue reading across adjacent header fields (up to ~355 bytes), overwriting return addresses and saved registers on the call stack of any caller of mtar_open(), mtar_find(), or mtar_read_header().
Know when Microtar gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
microtar through 0.1.0 contains a stack-based buffer overflow vulnerability in the raw_to_header() function in src/microtar.c that allows attackers to corrupt adjacent stack memory by supplying a crafted TAR archive with non-null-terminated name or linkname fields. The function uses strcpy() to copy 100-byte ustar format fields that lack null terminators, causing writes of up to 355 bytes into a 100-byte destination buffer when mtar_open(), mtar_find(), or mtar_read_header() process attacker-supplied TAR archives.
Executive ViewAI
microtar library (versions through 0.1.0) contains a remote code execution vulnerability in TAR archive parsing that enables attackers to execute arbitrary code by submitting malicious files. Organizations using this library to process untrusted archives face immediate exploitation risk; publicly available exploit code exists and the vendor has not released a patch.
Implement strict TAR file validation (reject files exceeding expected specifications, disable TAR format where not critical); require cryptographic verification of TAR archives before processing; apply network-level controls to restrict TAR file sources to trusted endpoints only; run TAR processing in isolated containers with minimal privileges; disable TAR parsing functionality entirely pending vendor patch if operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack buffer overflow in rxi's microtar C library allows memory corruption when an application archives files with attac
Stack-based buffer overflow in rxi microtar 0.1.0's raw_to_header() function allows a remote attacker to cause denial of
Denial of service through infinite CPU consumption affects rxi microtar 0.1.0, a lightweight C library for tar archive p
Exploit-DB