GHSA-ffxh-f67m-r64fMediumCVSS 5.5

A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack...

Published
November 12, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (1)

📋 Description

A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash.

🔗 References (4)