microtar exposes a stack buffer overflow in the mtar_write_file_header() and mtar_write_dir_header() functions, which copy a supplied entry name into a 100‑byte buffer using an unchecked strcpy. The overflow occurs whenever a filename longer than 99 characters is processed, corrupting the stack frame and allowing an attacker to overwrite the return address. The vulnerability is classified as CWE‑121 and provides a straightforward path to execute code with the privileges of the running process. If the process runs with elevated rights, the impact can extend to privilege escalation. Affected systems The vendor/product rxi:microtar is the source of the flaw. No specific version information is supplied, so any release that incorporates the original unbounded strcpy remains vulnerable. Applications that embed microtar to create archives—including those that accept user‑supplied or attacker‑controlled filenames—are also impacted. Based on the description, it is inferred that any usage of these functions with an externally influenced filename longer than 99 characters can trigger the overflow. Risk and exploitability With a CVSS score of 9.8 the vulnerability is rated critical, and the EPSS score is not listed, which indicates that no public data is currently available about exploitation frequency. The lack of bounds checking creates a simple exploitation route: provide a long filename either locally when creating an archive or remotely if the archiving capability is exposed over a network. Successful exploitation yields arbitrary local code execution; if the software runs with elevated privileges, attacker‑controlled code could also achieve privilege escalation. The vulnerability is not present in CISA’s KEV catalog.

The repository rxi:microtar is the vendor and product affected. No version list was supplied, so any release that still contains the original source from GitHub with the unbounded strcpy is vulnerable. Applications that embed microtar and process user‑supplied or attacker‑controlled filenames during archive creation are also impacted.

With a CVSS score of 9.8 the vulnerability is classified as critical. The EPSS score is not available, but the lack of bounds checking provides a straightforward exploitation path on any system running a vulnerable build. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires controlling the filename argument, which could be achieved either locally when a user creates an archive, or remotely if the archiving functionality is exposed over a network. A successful exploit would likely grant the attacker arbitrary local code execution, and if the process runs with elevated privileges, privilege escalation could follow.