Description
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.

This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
Published: 2026-08-10
Score: 4.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

GNU cpio contains an uncontrolled memory allocation flaw in its make_path function, where alloca allocates stack memory directly from the length of a pathname extracted from an archive. A malicious cpio file with a deeply nested pathname can trigger an unbounded stack allocation, causing a stack overflow and crashing the cpio process. This flaw (CWE‑789) results in a denial of service for the user running the extraction.

Affected Systems

All releases of GNU cpio prior to commit 3cd514031371d8aeeaf2048aa10103e02831aaa9 contain the flaw. The patch that resolves the issue is incorporated in newer releases of the project.

Risk and Exploitability

The CVSS score of 4.6 indicates a moderate risk, and the EPSS score of < 1% signals a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a malicious cpio archive to a user or service that performs extraction. Successful execution results in a crash of the cpio process, thereby denying service to the current session.

Generated by OpenCVE AI on August 13, 2026 at 09:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade GNU cpio to a release that includes commit 3cd514031371d8aeeaf2048aa10103e02831aaa9.
  • Rebuild or update any applications or packages that rely on the old cpio to link against the updated library.
  • As an interim measure, limit processing of untrusted archives by enforcing a maximum pathname length or disabling cpio extraction where feasible.

Generated by OpenCVE AI on August 13, 2026 at 09:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.0, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Mon, 10 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 10 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
Description GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
Title Uncontrolled Memory Allocation in GNU cpio
First Time appeared Gnu
Gnu cpio
Weaknesses CWE-789
CPEs cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*
Vendors & Products Gnu
Gnu cpio
References
Metrics cvssV4_0

{'score': 4.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Gnu Cpio
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-08-10T10:56:56.427Z

Reserved: 2026-07-27T11:32:08.682Z

Link: CVE-2026-66485

cve-icon Vulnrichment

Updated: 2026-08-10T10:56:52.730Z

cve-icon NVD

Status : Deferred

Published: 2026-08-10T11:17:27.773

Modified: 2026-08-28T15:26:19.533

Link: CVE-2026-66485

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-10T10:25:34Z

Links: CVE-2026-66485 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T10:00:05Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-789

    Memory Allocation with Excessive Size Value