CVE-2026-66485: CWE-789 Memory allocation with excessive size value in GNU cpio
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
AI Analysis
Technical Summary
The vulnerability in GNU cpio arises from the use of alloca in the make_path function to allocate stack memory proportional to the length of argpath, which is derived from the pathname in the archive being extracted. If an attacker supplies a cpio archive with an excessively long nested pathname, it causes an unbounded stack allocation leading to a stack overflow and process crash. This vulnerability can be exploited to cause denial of service when a victim extracts a malicious archive. The issue is tracked as CVE-2026-66485 and corresponds to CWE-789 (Memory Allocation with Excessive Size). The vulnerability has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9.
Potential Impact
Successful exploitation results in a denial of service due to a stack overflow and crash of the cpio process during archive extraction. There is no indication of privilege escalation or code execution. The attack requires the victim to extract a crafted cpio archive.
Mitigation Recommendations
A fix for this vulnerability is available and has been committed (commit 3cd514031371d8aeeaf2048aa10103e02831aaa9). Users should update to the fixed version of GNU cpio to remediate this issue. Patch status is not explicitly confirmed in the advisory, so verify the vendor repository or official GNU cpio sources for the fixed version. Until patched, avoid extracting untrusted cpio archives with potentially long nested pathnames.
CVE-2026-66485: CWE-789 Memory allocation with excessive size value in GNU cpio
Description
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
CVSS v4.0
Score 4.6medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in GNU cpio arises from the use of alloca in the make_path function to allocate stack memory proportional to the length of argpath, which is derived from the pathname in the archive being extracted. If an attacker supplies a cpio archive with an excessively long nested pathname, it causes an unbounded stack allocation leading to a stack overflow and process crash. This vulnerability can be exploited to cause denial of service when a victim extracts a malicious archive. The issue is tracked as CVE-2026-66485 and corresponds to CWE-789 (Memory Allocation with Excessive Size). The vulnerability has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9.
Potential Impact
Successful exploitation results in a denial of service due to a stack overflow and crash of the cpio process during archive extraction. There is no indication of privilege escalation or code execution. The attack requires the victim to extract a crafted cpio archive.
Mitigation Recommendations
A fix for this vulnerability is available and has been committed (commit 3cd514031371d8aeeaf2048aa10103e02831aaa9). Users should update to the fixed version of GNU cpio to remediate this issue. Patch status is not explicitly confirmed in the advisory, so verify the vendor repository or official GNU cpio sources for the fixed version. Until patched, avoid extracting untrusted cpio archives with potentially long nested pathnames.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CERT-PL
- Date Reserved
- 2026-07-27T11:32:08.682Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a79aaebbf8831d53985a8d8
Added to database: 08/10/2026, 10:41:47 UTC
Last enriched: 08/10/2026, 11:03:46 UTC
Last updated: 08/10/2026, 16:29:56 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.