CVE-2026-126831: Cpio: cpio: stack-based buffer overflow in write_out_tar_header() with long usernames/groupnames
A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash.
Other sources
A flaw was found in GNU cpio through version 2.15. A stack-based buffer overflow exists in src/tar.c:writeouttarheader() via settarfname().
When generating archives using the ustar or tar formats (e.g., cpio -o -H ustar), settarfname() uses unbounded strcpy() calls to copy user and group names obtained from getpwuid() and getgrgid() into the 32-byte fixed-size tarhdr->uname and tarhdr->gname fields within struct tarheader on the stack. If a file being archived is owned by a user or group whose name exceeds 32 characters (common in LDAP, Active Directory, or container environments), strcpy() overflows the destination buffer and corrupts adjacent stack variables.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the expected security impact?
The reported impact is limited to availability, rated high. The CVSS vector reports no confidentiality or integrity impact and no scope change.