CVE-2026-66485
Received Received - Intake

Stack Overflow in GNU cpio Due to Uncontrolled Memory Allocation

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: CERT.PL

Description
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-66485
EUVD
EUVD-2026-55255

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
gnu cpio to 3cd514031371d8aeeaf2048aa10103e02831aaa9 (inc)
gnu cpio *
gnu cpio From 3.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GNU cpio has an uncontrolled memory allocation flaw in the make_path function. When extracting archives, it uses alloca to allocate stack memory based on the length of a pathname from the archive. A malicious archive with an extremely long nested pathname causes excessive stack allocation, leading to a stack overflow and program crash. This results in a denial of service when a victim extracts the crafted archive.

Detection Guidance

To detect this vulnerability, monitor for crashes in cpio processes during archive extraction. Check for unusually long nested pathnames in archives. No specific commands are provided in the context.

Impact Analysis

If you extract a specially crafted cpio archive, the vulnerability could crash the cpio process on your system, causing a temporary denial of service. It does not appear to allow code execution or data theft, but repeated exploitation could disrupt operations relying on cpio for archive extraction.

Compliance Impact

This vulnerability causes a denial of service by crashing the cpio process through stack overflow, which may disrupt systems handling sensitive data. However, the provided context does not specify direct impacts on GDPR or HIPAA compliance beyond potential service disruption.

Mitigation Strategies

Update GNU cpio to the fixed version in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9. Avoid extracting archives from untrusted sources until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66485. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart