CVE-2026-66485 in cpio
Summary
by MITRE • 08/10/2026
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.
This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability in GNU cpio represents a critical stack-based buffer overflow condition that arises from improper memory management within the make_path function located in src/makepath.c. This flaw manifests when the application processes archive-controlled pathnames during extraction operations, specifically utilizing the alloca function to dynamically allocate stack space based on the length of the input argument path. The root cause stems from the lack of bounds checking on user-supplied pathname data, allowing an attacker to manipulate the allocation size through carefully crafted archive entries.
The technical implementation of this vulnerability leverages the alloca function's behavior of allocating memory on the call stack rather than the heap, making it particularly dangerous for stack-based systems. When a malicious cpio archive contains a nested pathname of excessive length, the make_path function computes an unbounded stack allocation that can quickly exhaust available stack space. This uncontrolled memory allocation pattern directly violates secure coding practices and represents a classic example of improper input validation in file processing operations.
From an operational perspective, this vulnerability creates a significant denial of service condition that can be easily exploited by remote attackers who can supply crafted cpio archives to unsuspecting victims. The impact extends beyond simple process termination since the stack overflow can potentially lead to more severe consequences including arbitrary code execution if proper stack protection mechanisms are not in place. The vulnerability affects systems where GNU cpio is used for archive extraction, particularly those handling untrusted archive content from external sources or user uploads.
The security implications of this flaw align with CWE-129, which addresses improper validation of length of input buffers, and CWE-131, which covers incorrect calculation of buffer size. Additionally, this vulnerability maps to ATT&CK technique T1499.001, specifically covering the exploitation of denial of service vulnerabilities in software applications. The fix implemented in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9 demonstrates proper mitigation through bounds checking and controlled memory allocation practices that prevent unbounded stack growth during archive processing operations.
Organizations should implement immediate mitigations including updating to the patched version of GNU cpio, deploying input validation controls for archive extraction processes, and establishing monitoring for suspicious archive content handling. Security teams should also consider implementing network segmentation and access controls to limit exposure to potentially malicious archive files while maintaining operational continuity through proper patch management procedures that address this specific memory allocation vulnerability.