CVE-2026-111273: unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name
unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in targetname() in tar/parse-tar.c, reachable through the arentrygetname() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted TAR archive whose ustar prefix and name fields are full. Exploitation is reachable when the application processes the archive through the ar_entry_get_name() API, and user interaction is required according to the supplied severity vector.
Which versions are affected?
unarr through version 1.1.1 is affected.
What is the likely impact?
The crafted archive causes tar_get_name() to write a NUL byte one byte past a heap allocation. This can corrupt heap memory and crash the process; the supplied severity vector indicates low integrity impact and high availability impact.