CVE-2026-66485: Uncontrolled Memory Allocation in GNU cpio
GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.
This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU cpioto a version that resolves this vulnerability.Patch 3cd514031371d8aeeaf2048aa10103e02831aaa9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66485?
CVE-2026-66485 has a risk rating of 26, indicating a high severity of uncontrolled memory allocation in GNU cpio.
How do I fix CVE-2026-66485?
To fix CVE-2026-66485, update GNU cpio to the latest version that addresses this memory allocation vulnerability.
What are the potential impacts of CVE-2026-66485?
CVE-2026-66485 can lead to stack overflow and potential execution of arbitrary code due to improper memory handling.
Which function in GNU cpio is affected by CVE-2026-66485?
The affected function in GNU cpio is make_path, located in src/makepath.c.
What type of attack does CVE-2026-66485 potentially enable?
CVE-2026-66485 potentially enables denial of service or arbitrary code execution through crafted cpio archives.