The vulnerability exists in the rxi microtar library's mtar_write_file_header and mtar_write_dir_header functions, which use strcpy to copy a caller-supplied entry name into a 100-byte stack-allocated buffer (mtar_header_t.name) without checking that the input length is less than 100 bytes. This lack of bounds checking can cause a stack-based buffer overflow (CWE-121), potentially allowing an attacker to execute arbitrary code or cause a denial of service. The vulnerability is publicly documented as CVE-2026-71267 with a CVSS v3.1 score of 9.8.

Successful exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected system due to stack-based buffer overflow. This may allow remote code execution or application crashes. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted input with the affected functions or apply manual input length validation to ensure entry names do not exceed 99 characters.