Heap-based Buffer Overflow Vulnerability in entr by Eradman

CVE-2026-18370

What is CVE-2026-18370?

The entr utility is susceptible to a heap-based buffer overflow due to improper handling of command-line arguments in the run_utility() function. When the function allocates a fixed-size heap buffer but fails to calculate the exact space needed based on its return value, it creates potential for memory corruption. This vulnerability can be exploited locally by attackers through crafted command-line arguments or specific substitution features, leading to potential memory corruption, process termination, or service disruption. A patch has been implemented to address this issue in commit 2467fe0.

References