The vulnerability is a heap‑based buffer overflow (CWE-122) located in the run_utility() function of entr. It allocates a fixed buffer of size ARG_MAX and then copies command‑line arguments into it. Because strlcpy() reports the total length of the source string rather than the number of bytes written, the code incorrectly advances the destination pointer by the full source length. When the buffer is exactly filled, the remaining size underflows as an unsigned value, causing subsequent copies to write past the buffer’s end. This can be triggered by carefully crafted arguments whose combined length precisely fills the buffer or by using the /_ substitution feature, which expands short tokens into longer pathnames at runtime. The overflow leads to memory corruption, can cause the process to abort, and results in a denial of service for the local attacker.

The affected product is entr, released by Eradman. No specific affected version ranges are listed; the issue is present in versions prior to the commit that fixes the overflow.

The CVSS score of 4.8 indicates a low‑to‑medium severity. The EPSS score of 0.00131 suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need local access and the ability to invoke entr with a crafted argument list or to exploit the /_ substitution. The impact is limited to memory corruption and possible process termination, which translates into a denial of service for the process or affected host.