CVE-2026-66486: Improper Output Encoding in GNU cpio

Published Aug 10, 2026

Updated

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.

This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

Affected Software

1 affected component

GNU cpio

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GNU cpio to a version that resolves this vulnerability.
Patch 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

Event History

Aug 10, 2026

CVE Published

via MITRE·10:25 AM

Data Sourced

via MITRE·10:25 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2026-66486?

The severity of CVE-2026-66486 is rated at 18, indicating a significant security risk.

How do I fix CVE-2026-66486?

To fix CVE-2026-66486, update to the latest version of GNU cpio that resolves the improper encoding issue.

What types of attacks can exploit CVE-2026-66486?

CVE-2026-66486 can be exploited through crafted cpio archives that include member names with embedded special characters.

In which versions of GNU cpio does CVE-2026-66486 exist?

CVE-2026-66486 exists in affected versions of GNU cpio prior to the patch that addresses the output encoding flaw.

What is the impact of CVE-2026-66486?

The impact of CVE-2026-66486 includes potential denial of service or execution of malicious commands through improper output when listing archive members.