eradman CVE debriefs

CVE-2026-18370

The entr utility is vulnerable to a heap-based buffer overflow in the run_utility() function. This function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. The function uses strlcpy() to copy the arguments, but strlcpy() returns the total length of the source string, not the number of bytes written. This can cause an underflow when the buffer is exactly [truncated]