What’s Vulnerable › Vulnerabilities

CVE-2026-54417: Integer Overflow in rxi/microtar mtar_next() Causes Infinite Loop DoS

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-17 · updated 2026-10-26
• Weakness: CWE-190

Description

An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. mtar_next computes the offset to the next record as round_up(h.size, 512) + sizeof(mtar_raw_header_t) using 32-bit arithmetic.

Affected products

• rxi microtar: 0.1.0

References

• https://github.com/rxi/microtar
• https://github.com/rxi/microtar/blob/master/src/microtar.c#L239
• https://raw.githubusercontent.com/rxi/microtar/master/src/microtar.c

Get alerted when CVE-2026-54417 or the next vulnerability affects your stack