CVE-2026-18370 eradman CVE debrief

Who should care

Users of the entr utility, especially those who expose it to untrusted input, should be aware of this vulnerability. Assess your environment's exposure and take appropriate actions. This includes reviewing system configurations, monitoring for suspicious activity, and applying patches or mitigations as needed.

Technical summary

The run_utility() function in entr allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. The function uses strlcpy() to copy the arguments, but strlcpy() returns the total length of the source string, not the number of bytes written. This can cause an underflow when the buffer is exactly filled, leading to out-of-bounds writes. An attacker can trigger this by supplying command-line arguments that fill the buffer or using the /_ substitution feature. Limited information is available about affected products and versions.

Defensive priority

Local attackers may exploit this vulnerability to cause memory corruption, process abort, and denial of service. Assess and prioritize based on your environment's exposure.

Recommended defensive actions

• Inventory and assess entr installations in your environment.
• Apply the fix from commit 2467fe0aa5f2b1b074110a9186ef51d35809c9a4 if applicable.
• Monitor for suspicious activity related to entr.
• Implement compensating controls such as restricting access to entr.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-18370 record indicates a heap-based buffer overflow in the run_utility() function of entr. The function allocates a fixed-size heap buffer and copies command-line arguments into it, potentially causing out-of-bounds writes when the buffer is exactly filled. Limited information is available about affected products and versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.