🚨High - rxi microtar Stack-Based Buffer Overflow in TAR Header Parsing (CVE-2026-55738) The microtar C library's raw_to_header() function copies the 100-byte name and linkname fields of a TAR header using strcpy() without ensuring the source is null-terminated. Since the POSIX ustar format allows these fixed-width fields to be fully filled with non-null bytes, a crafted archive whose linkname (plus the trailing padding of the 512-byte raw header) lacks a null terminator makes strcpy() read past the raw header stack buffer and write past the destination buffer. A remote attacker who gets a victim to open or parse a malicious TAR archive via mtar_open(), mtar_read_header(), or mtar_find() can trigger an out-of-bounds read and stack overflow, causing a crash and potentially arbitrary code execution. Confirmed with AddressSanitizer at src/microtar.c:112. 👉Affected: rxi microtar 0.1.0.
Post summary
A high‑severity stack‑based buffer overflow in rxi microtar’s TAR header parsing has been disclosed, enabling potential arbitrary code execution via a crafted archive.