rxi microtar up to 0.1.0 TAR src/microtar.c raw_to_header stack-based overflow

Summaryinfo

A vulnerability marked as critical has been reported in rxi microtar up to 0.1.0. This affects the function raw_to_header of the file src/microtar.c of the component TAR Handler. Performing a manipulation results in stack-based overflow. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is cataloged as CVE-2026-43623. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical has been found in rxi microtar up to 0.1.0. This affects the function raw_to_header of the file src/microtar.c of the component TAR Handler. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

microtar through 0.1.0 contains a stack-based buffer overflow vulnerability in the raw_to_header() function in src/microtar.c that allows attackers to corrupt adjacent stack memory by supplying a crafted TAR archive with non-null-terminated name or linkname fields. The function uses strcpy() to copy 100-byte ustar format fields that lack null terminators, causing writes of up to 355 bytes into a 100-byte destination buffer when mtar_open(), mtar_find(), or mtar_read_header() process attacker-supplied TAR archives.

The weakness was shared by Saidakbarxon Maxsudxonov and Byambadalai Sumiya as 28. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-43623 since 05/01/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/01/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• rxi

Name

• microtar

Version

• 0.1.0

Support

• end of life

Website

• Product: https://github.com/rxi/microtar/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion