CVE-2026-43623 is a stack-based buffer overflow vulnerability in the rxi microtar library (up to version 0.1.0) within the raw_to_header() function in src/microtar.c. The vulnerability arises because the function uses strcpy() to copy 100-byte ustar format fields that may lack null terminators, allowing an attacker to supply a crafted TAR archive with non-null-terminated name or linkname fields. This causes writes of up to 355 bytes into a 100-byte stack buffer, corrupting adjacent memory when mtar_open(), mtar_find(), or mtar_read_header() process the malicious archive. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity, and requires no privileges or user interaction to exploit.

Successful exploitation can lead to corruption of adjacent stack memory, potentially causing application crashes or enabling arbitrary code execution depending on the context in which microtar is used. The vulnerability affects all users processing untrusted TAR archives with vulnerable microtar versions. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted TAR archives with vulnerable versions of microtar. Monitoring vendor channels for updates is recommended.