microtar exposes a stack buffer overflow in mtar_write_file_header() and mtar_write_dir_header() functions in src/microtar.c. These functions copy a caller‑supplied entry name into a 100‑byte field of a stack‑allocated mtar_header_t via strcpy(h.name, name) without ensuring the string length is less than 100. When a name longer than 99 characters is processed, the buffer overflows and corrupts the stack frame, enabling an attacker to overwrite the process context or inject arbitrary code. The vulnerability is classified as CWE‑120 and CWE‑121 and provides a straightforward path for code execution with the privileges of the running process. If the process runs with elevated rights, the impact can extend to privilege escalation.

The repository rxi:microtar is the vendor and product affected. No version list was supplied, so any release that still contains the original source from GitHub with the unbounded strcpy is vulnerable. Applications that embed microtar and process user‑supplied or attacker‑controlled filenames during archive creation are also impacted.

With a CVSS score of 9.8 the vulnerability is classified as critical, and the EPSS score is 0.0034 (0.34%), indicating a very low probability of exploitation. Based on the description, it is inferred that the likely attack vector involves controlling the filename argument, which could be achieved either locally when a user creates an archive, or remotely if the archiving functionality is exposed over a network. The lack of bounds checking creates a simple exploitation route on any system running a vulnerable build. A successful exploit would likely grant the attacker arbitrary local code execution; if the process runs with elevated privileges, privilege escalation could follow. The vulnerability is not listed in CISA’s KEV catalog.