Skip to content
fr Sign in
4.6 Medium

CVE-2026-66485 GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c

Description

GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9

Affected products and versions

Product Affected versions Fixed in
cpio 2.15 earliest → 2.15 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of cpio

The 3 CVEs of cpio →
CVE-2026-66486 GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality 4.6 Medium CVE-2026-66484 GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality 4.6 Medium
Track this CVE