What’s Vulnerable › Vulnerabilities

CVE-2026-43623: microtar 0.1.0 Stack-Based Buffer Overflow via raw_to_header()

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-01 · updated 2026-07-22
• Weakness: CWE-121

Description

microtar through 0.1.0 contains a stack-based buffer overflow vulnerability in the raw_to_header() function in src/microtar.c that allows attackers to corrupt adjacent stack memory by supplying a crafted TAR archive with non-null-terminated name or linkname fields. The function uses strcpy() to copy 100-byte ustar format fields that lack null terminators, causing writes of up to 355 bytes into a 100-byte destination buffer when mtar_open(), mtar_find(), or mtar_read_header() process attacker-supplied TAR archives.

Affected products

• rxi microtar: through 0.1.0

References

• https://github.com/rxi/microtar/issues/28
• https://github.com/rxi/microtar/issues/29
• https://github.com/rxi/microtar/issues/30
• https://www.vulncheck.com/advisories/microtar-stack-based-buffer-overflow-via-raw-to-header

Get alerted when CVE-2026-43623 or the next vulnerability affects your stack