EUVD-2026-33741
GHSA-mwwm-v74q-mvh9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
microtar through 0.1.0 contains a stack-based buffer overflow vulnerability in the raw_to_header() function in src/microtar.c that allows attackers to corrupt adjacent stack memory by supplying a crafted TAR archive with non-null-terminated name or linkname fields. The function uses strcpy() to copy 100-byte ustar format fields that lack null terminators, causing writes of up to 355 bytes into a 100-byte destination buffer when mtar_open(), mtar_find(), or mtar_read_header() process attacker-supplied TAR archives.
AnalysisAI
Stack-based buffer overflow in microtar through 0.1.0 allows remote attackers to corrupt stack memory and potentially achieve code execution when an application using the library parses a malicious TAR archive. The flaw in raw_to_header() uses strcpy() on non-null-terminated 100-byte ustar fields, enabling writes of up to 355 bytes into a 100-byte buffer. Publicly available exploit code exists and the issue was reported by VulnCheck, raising the practical risk despite no current CISA KEV listing.
Technical ContextAI
microtar is a small single-file C library by rxi (cpe:2.3:a:rxi:microtar) used by embedded systems, games, and tooling to read and write TAR archives. The bug is a textbook CWE-121 stack-based buffer overflow: the ustar header format reserves fixed 100-byte fields for name and linkname that are NOT required to be null-terminated when fully populated, yet raw_to_header() copies them with strcpy(), which only stops at a null byte. A crafted header that omits terminators causes strcpy to continue reading across adjacent header fields (up to ~355 bytes), overwriting return addresses and saved registers on the call stack of any caller of mtar_open(), mtar_find(), or mtar_read_header().
RemediationAI
No vendor-released patch identified at time of analysis - upstream issues #28, #29, and #30 at https://github.com/rxi/microtar/issues track the report but no tagged release beyond 0.1.0 is referenced in the provided data; monitor the repository for a fixed release. As compensating controls, downstream maintainers should patch their vendored copy of src/microtar.c by replacing the strcpy() calls in raw_to_header() with bounded copies (memcpy of 100 bytes followed by explicit null termination, or strnlen-validated copies) - this is a minimal change with no functional side effect. Applications that accept TAR archives from untrusted sources should additionally validate that name and linkname fields contain a null terminator within the first 100 bytes before invoking mtar_open(), mtar_find(), or mtar_read_header(), and treat untrusted archive parsing as a privilege boundary by sandboxing the process (seccomp, separate UID, or a parser subprocess), accepting the trade-off of slightly higher complexity in archive handling pipelines. Consult the VulnCheck advisory for further detail.
Stack buffer overflow in rxi's microtar C library allows memory corruption when an application archives files with attac
Stack-based buffer overflow in rxi microtar 0.1.0's raw_to_header() function allows a remote attacker to cause denial of
Denial of service through infinite CPU consumption affects rxi microtar 0.1.0, a lightweight C library for tar archive p
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today