Description
unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.
Published: 2026-10-15
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via Off‑by‑One Heap Buffer Overflow
Action: Patch
AI Analysis

Impact

An off‑by‑one heap buffer overflow (CWE‑193) occurs in the tar_get_name function of the unarr library. When a TAR archive contains a full ustar prefix and a file name that together exceed the allocated buffer, the ar_entry_get_name API writes a NUL byte one byte beyond the buffer’s boundary, corrupting adjacent heap memory and causing the program to crash. The vulnerability does not allow arbitrary code execution, but it can force a service to terminate.

Affected Systems

The unarr component developed by selmf is affected; no specific version data is available in the CVE entry, so any deployment that imports the unarr library and processes TAR files via the ar_entry_get_name API must be considered at risk.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. The EPSS score of < 1% signifies a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker must deliver a carefully crafted TAR archive to an application that uses unarr via the ar_entry_get_name API. This can lead to repeated crashes and service disruption without enabling code execution.

Generated by OpenCVE AI on October 16, 2026 at 16:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a patched release of unarr when one is available.
  • Add bounds checking around the ar_entry_get_name call to validate the combined length of the ustar prefix and file name against the allocated buffer.
  • Execute unarr extraction in a sandboxed or isolated environment to contain any crash and protect the host system.

Generated by OpenCVE AI on October 16, 2026 at 16:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Description unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.
Title unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name
Weaknesses CWE-193
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-16T19:39:08.849Z

Reserved: 2026-10-15T19:33:20.652Z

Link: CVE-2026-111273

cve-icon Vulnrichment

Updated: 2026-10-16T19:38:57.340Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T22:19:28.333

Modified: 2026-10-16T20:17:19.853

Link: CVE-2026-111273

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T16:45:14Z

Weaknesses