GNU cpio up to 2.15 src/makepath.c make_path stack-based overflow

Summaryinfo

A vulnerability has been found in GNU cpio up to 2.15 and classified as problematic. The impacted element is the function make_path of the file src/makepath.c. The manipulation leads to stack-based overflow. This vulnerability is listed as CVE-2026-66485. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in GNU cpio up to 2.15 and classified as problematic. This issue affects the function make_path of the file src/makepath.c. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is availability. The summary by CVE is:

GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9

It is possible to read the advisory at cert.pl. The identification of this vulnerability is CVE-2026-66485 since 07/27/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Applying the patch 3cd514031371d8aeeaf2048aa10103e02831aaa9 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-2722). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Open Source cpio

Productinfo

Vendor

• GNU

Name

• cpio

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion