The microtar library's functions mtar_write_file_header() and mtar_write_dir_header() in src/microtar.c use strcpy to copy a caller-supplied entry name into a 100-byte stack-allocated buffer (h.name) without validating that the input length is less than 100 bytes. If an application using microtar archives user-supplied or attacker-controlled filenames longer than 99 characters, this triggers a stack buffer overflow (CWE-121). The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

Exploitation of this vulnerability can result in a stack buffer overflow, potentially allowing an attacker to execute arbitrary code, crash the application, or cause denial of service. Since the vulnerability is triggered by processing attacker-controlled filenames, any application using microtar to archive untrusted input is at risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should avoid archiving filenames longer than 99 characters or implement input validation to restrict filename length before passing to microtar functions.