References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

{"timestamp":"2026-08-05T15:54:06.623542Z","id":"CVE-2026-71267","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

microtar's mtar_write_file_header() and mtar_write_dir_header() functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte `name` field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy. Any application that calls these functions with an externally-influenced filename longer than 99 characters (e.g. when archiving user-supplied or attacker-controlled filenames) triggers a stack buffer overflow.

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-121

https://github.com/rxi/microtar

https://github.com/rxi/microtar/blob/master/src/microtar.c

[{"vendor":"rxi","product":"microtar","defaultStatus":"unaffected","programFiles":["src/microtar.c"],"versions":[{"version":"0","lessThanOrEqual":"*","versionType":"custom","status":"affected"}]}]