CVE-2026-55738: CWE-121 Stack-based Buffer Overflow in rxi microtar
A stack-based buffer overflow exists in the raw_to_header function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy without guaranteeing null termination of the source.
AI Analysis
Technical Summary
The vulnerability CVE-2026-55738 affects rxi microtar version 0.1.0. The raw_to_header function copies the name and linkname fields of a TAR header using strcpy without guaranteeing that the source strings are null-terminated. This improper handling can cause a stack-based buffer overflow (CWE-121) and improper string termination (CWE-170). The CVSS 3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code, cause application crashes, or disrupt service availability due to the stack-based buffer overflow. The vulnerability affects confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
No official patch or remediation is currently available for this vulnerability. Users of rxi microtar version 0.1.0 should monitor the vendor's advisories for updates. Until a fix is released, avoid processing untrusted TAR archives with this version to mitigate risk.
CVE-2026-55738: CWE-121 Stack-based Buffer Overflow in rxi microtar
Description
A stack-based buffer overflow exists in the raw_to_header function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy without guaranteeing null termination of the source.
CVSS v3.1
Score 8.8high
Affected software
rxi
microtar
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-55738 affects rxi microtar version 0.1.0. The raw_to_header function copies the name and linkname fields of a TAR header using strcpy without guaranteeing that the source strings are null-terminated. This improper handling can cause a stack-based buffer overflow (CWE-121) and improper string termination (CWE-170). The CVSS 3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code, cause application crashes, or disrupt service availability due to the stack-based buffer overflow. The vulnerability affects confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
No official patch or remediation is currently available for this vulnerability. Users of rxi microtar version 0.1.0 should monitor the vendor's advisories for updates. Until a fix is released, avoid processing untrusted TAR archives with this version to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TuranSec
- Date Reserved
- 2026-06-17T12:59:17.620Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a32a8a90b89be68886361c0
Added to database: 06/17/2026, 14:01:13 UTC
Last enriched: 08/10/2026, 13:05:32 UTC
Last updated: 09/13/2026, 22:01:35 UTC
Views: 263
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.