CVE-2026-71267 in microtar
Summary
by MITRE • 08/05/2026
microtar's mtar_write_file_header() and mtar_write_dir_header() functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte `name` field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy. Any application that calls these functions with an externally-influenced filename longer than 99 characters (e.g. when archiving user-supplied or attacker-controlled filenames) triggers a stack buffer overflow.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability resides in microtar's implementation of file and directory header writing functions where insufficient input validation leads to stack-based buffer overflow conditions. The mtar_write_file_header() and mtar_write_dir_header() functions in src/microtar.c directly copy caller-supplied entry names into a 100-byte stack-allocated mtar_header_t structure using strcpy without bounds checking. This fundamental flaw violates secure coding practices and creates exploitable conditions when processing externally-influenced input data.
The technical implementation demonstrates a classic buffer overflow vulnerability where the name field within the mtar_header_t structure is allocated on the stack with only 100 bytes of space, yet the code performs no length validation before copying data. When an attacker provides a filename exceeding 99 characters, the strcpy operation overflows the name field and potentially corrupts adjacent stack memory including return addresses and local variables. This vulnerability maps directly to CWE-121 Stack-based Buffer Overflow with a severity classification indicating high impact potential for exploitation.
The operational impact of this vulnerability extends beyond simple data corruption as it creates opportunities for arbitrary code execution through stack smashing techniques. An attacker who can control the filename passed to these functions could potentially overwrite critical stack metadata, redirect program flow, or inject malicious payloads. The vulnerability affects any application that utilizes microtar's archive creation capabilities and processes user-supplied filenames without proper validation, making it particularly dangerous in file processing applications, backup systems, or archive utilities.
Mitigation strategies should focus on implementing input length validation before string operations and adopting safer string handling functions such as strlcpy or strncpy with appropriate bounds checking. The recommended approach involves validating that strlen(name) is less than 100 bytes before copying to the header structure, aligning with defensive programming principles from the software security community. Additionally, modern compiler security features like stack canaries, address space layout randomization, and control flow integrity should be enabled to reduce exploitation success rates. This vulnerability also relates to ATT&CK technique T1059 Command and Scripting Interpreter where attackers may leverage such buffer overflows to execute malicious code through compromised archive processing applications.