Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-05T12:26:14 microtar: microtar: Stack buffer overflow via overly long filenames 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-120

microtar's mtar_write_file_header() and mtar_write_dir_header() functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte `name` field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy. Any application that calls these functions with an externally-influenced filename longer than 99 characters (e.g. when archiving user-supplied or attacker-controlled filenames) triggers a stack buffer overflow.

A flaw was found in microtar. The mtar_write_file_header() and mtar_write_dir_header() functions copy a caller-supplied entry name into a fixed 100-byte stack buffer using strcpy() without validating the name length. An application that archives an attacker-controlled or externally supplied filename longer than 99 characters can trigger a stack buffer overflow, which could lead to arbitrary code execution or denial of service.

This Important flaw in microtar allows a stack buffer overflow when applications process externally-influenced filenames exceeding 99 characters. Exploitation could lead to a denial of service or potentially arbitrary code execution if an application using microtar archives attacker-controlled input without proper validation. Red Hat rates this issue with User Interaction Required (UI:R). Exploitation depends on an application using microtar to archive a caller-supplied entry name longer than 99 characters. That path typically needs a user or application action that supplies the filename, rather than a fully automated remote attack with no interaction. The CNA assessment uses UI:N; Red Hat's score reflects this precondition. No practical library-level workaround or fixed upstream release is published; all versions are reported affected. Applications that embed microtar should reject or truncate entry names to fewer than 100 bytes before calling mtar_write_file_header() / mtar_write_dir_header(), or replace microtar with a maintained tar implementation. Until a patched microtar is available, avoid archiving untrusted or attacker-controlled filenames with this library. https://www.cve.org/CVERecord?id=CVE-2026-71267 https://nvd.nist.gov/vuln/detail/CVE-2026-71267 https://github.com/rxi/microtar https://github.com/rxi/microtar/blob/master/src/microtar.c