Skip to content

CVE-2026-66485 on CTRL-OS 26.05

Aliases: CVE-2026-66485

Packages: cpio

Status: Plausible

Advisory Information

GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.

This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9

Updates

2026-08-21 15:20 CEST

Metadata changes:

  • Status for package cpio: “Plausible”

2026-08-21 15:18 CEST

Metadata changes:

  • Status for package cpio: “New”