CVE-2026-66485
published 2026-08-10CVE-2026-66485: GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory…
PriorityP421medium4.6CVSS 4.0
AVLACLATNPRNUIAVCNVINVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.13%
3.1th percentile
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.
This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | cpio | <= 2.15 | — |
| gnu | cpio | — | — |
| ubuntu | cpio | — | — |
CVSS provenance
nvdv4.04.6MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat4.6MEDIUM
vendor_ubuntu4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GNU cpio vulnerabilities
vendor_ubuntu·2026-08-31·CVSS 4.6
CVE-2026-66485 [MEDIUM] GNU cpio vulnerabilities
Title: GNU cpio vulnerabilities
Summary: Several security issues were fixed in GNU cpio.
It was discovered that cpio incorrectly sanitized hard-link targets when
extracting tar archives in copy-in mode. If a user or automated system
were tricked into extracting a specially crafted tar archive, an attacker
could possibly use this issue to create hard links to files outside the
extraction directory, even when using the --no-absolute-filenames option.
(CVE-2026-66484)
It was discovered that cpio did not properly bound the stack memory
allocated for pathnames during archive extraction. If a user or automated
system were tricked into extracting a specially crafted cpio archive, an
attacker could possibly use this issue to cause cpio to crash, resulting
in a denial of service. (CVE-2026-66485
Red Hat
cpio: GNU cpio: Denial of Service via uncontrolled memory allocation from crafted archives
vendor_redhat·2026-08-10·CVSS 4.6
CVE-2026-66485 [MEDIUM] CWE-120 cpio: GNU cpio: Denial of Service via uncontrolled memory allocation from crafted archives
cpio: GNU cpio: Denial of Service via uncontrolled memory allocation from crafted archives
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.
This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
A flaw was found in GNU cpio. This vulnerability involves uncontrolled memory allocation wh
GHSA
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c.
ghsa_unreviewed·2026-08-10
CVE-2026-66485 [MEDIUM] CWE-789 GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c.
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.
This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
No detection rules found.
No public exploits indexed.
2026-08-10
Published