PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55738 rxi CVE debrief

A high-severity stack-based buffer overflow vulnerability exists in the microtar library, specifically in the raw_to_header() function. This function improperly handles the copying of 100-byte name and linkname fields from a TAR header, leading to potential out-of-bounds reads and writes. A remote attacker can exploit this by supplying a crafted TAR archive, potentially leading to denial of service or arbitrary code execution. The vulnerability has a CVSS score of 8.7 and is considered high severity. Users who parse or open TAR archives with microtar are advised to take immediate action.

Vendor
rxi
Product
microtar
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-08-10
Advisory published
2026-06-17
Advisory updated
2026-08-10

Who should care

Developers and users of the microtar library, especially those who handle TAR archives from untrusted sources, should be aware of this vulnerability. Applications that use microtar to parse or open TAR archives are potentially exposed to denial of service or code execution attacks.

Technical summary

The raw_to_header() function in src/microtar.c uses strcpy() to copy the 100-byte name and linkname fields from a TAR header without ensuring null termination of the source. Since the POSIX ustar format allows these fields to be fully populated with non-null bytes, a specially crafted archive can cause strcpy() to read past the end of the 512-byte raw header stack buffer and write past the destination header buffer. This can lead to an out-of-bounds read and a stack buffer overflow.

Defensive priority

High

Recommended defensive actions

  • Update to the latest version of microtar if available.
  • Use safe functions like strncpy() or snprintf() that allow for bounds checking.
  • Validate and sanitize TAR archive inputs to prevent crafted archives from being processed.
  • Implement additional error checking around TAR parsing functions.
  • Consider using alternative TAR parsing libraries with built-in security features.
  • Monitor for and block suspicious TAR archive uploads or processing requests.

Evidence notes

The vulnerability was confirmed using AddressSanitizer, which detected a stack-buffer-overflow READ of size 356 in raw_to_header at src/microtar.c:112. The CVE record and NVD detail provide additional context and references to the vulnerable code.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-55738 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-55738

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-55738 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-55738

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/rxi/microtar

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

  • Source reference

    Unverified legacy reference

    URL: https://github.com/rxi/microtar/blob/master/src/microtar.c

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

  • Source reference

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/rxi/microtar/master/src/microtar.c

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.