Stack-Based Buffer Overflow in Cpio Affects Red Hat Products
CVE-2026-126831

5.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
12 November 2026

What is CVE-2026-126831?

A vulnerability exists in Cpio that enables a local user to induce a Denial of Service by exploiting a stack-based buffer overflow during the creation of archives in tar or ustar formats. This flaw arises when file names associated with users or groups exceed 32 characters. Cpio fails to validate the length of these names, resulting in an unbounded memory copy that corrupts stack memory, ultimately leading to application crashes.

References

https://access.redhat.com/security/cve/CVE-2026-126831
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2571893
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.