The vulnerability in eradman entr (CVE-2026-18370) is a heap-based buffer overflow in the run_utility() function. The function allocates a fixed-size buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string rather than the number of bytes written. When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing subsequent copies to write out of bounds. This can be triggered by supplying command-line arguments whose combined length fills the buffer or via the /_ substitution feature that expands a short token into a longer pathname at runtime. The flaw allows a local attacker to cause memory corruption, process abort, and denial of service. The issue was fixed in commit 2467fe0.

A local attacker can exploit this vulnerability to cause memory corruption, which may lead to process abort and denial of service. There is no indication of privilege escalation or remote exploitation. The CVSS 4.0 base score is 4.8 (medium severity), reflecting local attack vector with low complexity and limited impact on confidentiality and integrity.

The vulnerability has been fixed in commit 2467fe0. Users should upgrade to a version of entr that includes this fix. Since no official patch version number is provided, users should check the vendor repository or official sources for the fixed version beyond 5.8. Until patched, avoid supplying command-line arguments that fill the buffer exactly or using the /_ substitution feature with untrusted input.