EUVD-2026-53352
GHSA-3h9h-4m9g-9m4r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply overlong archive filename
-
DeliveryApplication passes name to mtar_write_*_header
-
Exploitstrcpy overruns 100-byte stack buffer
-
ExecutionCorrupt saved stack frame
-
ImpactHijack control flow or crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the embedding application call mtar_write_file_header() or mtar_write_dir_header() with an entry name whose length is 100 bytes or greater and that this name be influenced by an attacker (e.g. user-uploaded or attacker-named files being archived). Limiting factors: the flaw is not directly reachable unless the host application passes long, externally-controlled filenames into these specific write functions, so a purely local/config-only tool with trusted inputs is not exposed; reliable code execution (versus a crash) is further constrained by compiler stack protections, ASLR, and platform ABI. The CVSS AV:N assumes the vulnerable call is reachable over a network path, which is application-specific and not guaranteed by the library itself - verify the actual call site before assuming remote reach. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) treats this as remote unauthenticated critical RCE, but that rating assumes a specific deployment where attacker-controlled filenames reach the vulnerable function over the network - microtar is a library, not a network service, so the true attack vector is entirely dependent on the embedding application. This is a case where CVSS overstates intrinsic risk: reachability, exploitability past stack canaries/ASLR/NX, and whether long names are even network-exposed all vary by integrator. No EPSS score, KEV listing, SSVC decision, or POC is present in the provided data, so there is no signal of active or automatable exploitation. Realistic priority is moderate: the bug is genuine and easy to trigger for a crash/DoS, but weaponized remote code execution requires a vulnerable downstream application and is not demonstrated. Treat the 9.8 as an upper bound pending confirmation of a real reachable, network-facing call site. |
| Exploit ScenarioDerived | An application uses microtar to build a tar archive from filenames supplied by an external actor - for example a web service that lets users name files that are later archived. The attacker submits a filename of 100+ bytes, which flows into mtar_write_file_header() and overflows the 100-byte stack buffer, corrupting adjacent stack memory to cause a crash or, with a crafted payload defeating stack protections, hijack control flow. No public POC is available, so any working exploit would have to be developed against the specific target application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
Stack buffer overflow in rxi's microtar C library allows memory corruption when an application archives files with attacker-influenced names longer than 99 characters. The mtar_write_file_header() and mtar_write_dir_header() functions use an unbounded strcpy() into a fixed 100-byte stack buffer, so any calling program that feeds externally-controlled filenames into these APIs is exposed to potential code execution or crash. No public exploit identified at time of analysis, and the library is not listed in CISA KEV, but the missing length check is trivially reachable in code that tars user-supplied paths.
RemediationAI
No vendor-released patch identified at time of analysis; the only references are the upstream repository (https://github.com/rxi/microtar) and source file, with no tagged fixed release. As an immediate code-level fix, integrators should patch mtar_write_file_header() and mtar_write_dir_header() to reject or truncate names where strlen(name) >= 100 (for example replace strcpy with a bounded copy such as snprintf(h.name, sizeof(h.name), "%s", name) or an explicit length guard that returns an error like MTAR_EWRITEFAIL). Until an upstream fix is available, callers should validate and cap filename length to 99 bytes before passing values into these functions, and sanitize any user- or network-sourced paths at the application boundary; the trade-off is that legitimately long names will be rejected or truncated, so archive fidelity for such entries is lost. Compiling the embedding application with stack canaries (-fstack-protector-strong), FORTIFY_SOURCE, ASLR, and non-executable stacks reduces the chance a triggered overflow becomes code execution rather than a crash.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
microtar is a minimal single-file tar archive library written in C (src/microtar.c) by developer rxi, commonly embedded in other projects for reading and writing tar streams. The mtar_header_t structure defines a fixed 100-byte name field mirroring the POSIX/ustar tar header name field. The vulnerable code path performs strcpy(h.name, name) with no prior strlen() bounds check, so a name of 100 or more bytes overruns the stack-allocated header structure. This is a textbook CWE-121 (Stack-based Buffer Overflow) caused by use of an unbounded string copy on a caller-supplied input, a root-cause class that classic tar tooling avoids by truncating or splitting long names into the prefix field.
Know when Microtar gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Kept network vector since attacker-controlled names may arrive remotely, but raised to AC:H because exploitation depends on a reachable call site and defeating stack protections; full C/I/A impact reflects potential code execution.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
DescriptionCVE.org
microtar's mtar_write_file_header() and mtar_write_dir_header() functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte name field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy. Any application that calls these functions with an externally-influenced filename longer than 99 characters (e.g. when archiving user-supplied or attacker-controlled filenames) triggers a stack buffer overflow.
Executive ViewAI
A critical stack buffer overflow in rxi's microtar C library (CVSS 9.8) enables arbitrary code execution when processing tar archives with malicious filenames longer than 99 characters. Any application embedding this library is vulnerable if it processes externally-supplied or untrusted tar files, directly exposing dependent systems and end users to potential compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Pre-archive filename validation-reject any filename longer than 99 characters before processing; (2) Source restriction-process only digitally signed or internally-generated tar archives; (3) Privilege isolation-execute tar operations with minimal system privileges in a containerized or OS-level sandbox; (4) Network controls-if tar uploads occur via web service, deploy WAF rules to block suspicious or oversized archives.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in microtar through 0.1.0 allows remote attackers to corrupt stack memory and potentially ac
Stack-based buffer overflow in rxi microtar 0.1.0's raw_to_header() function allows a remote attacker to cause denial of
Denial of service through infinite CPU consumption affects rxi microtar 0.1.0, a lightweight C library for tar archive p
Exploit-DB