Integer Overflow Vulnerability in rxi microtar Product
CVE-2026-54417

8.7HIGH

Key Information:

Vendor

Rxi

Status
Microtar
Vendor
CVE Published:
17 June 2026

What is CVE-2026-54417?

The rxi microtar library suffers from an integer overflow issue in the mtar_next() function, leading to a denial of service. Attackers can exploit this vulnerability by providing a specially crafted tar archive that triggers infinite loops, causing the application to hang and consume 100% CPU. This occurs when header sizes of specific values cause the calculated offset to wrap around to zero instead of advancing to the next record, resulting in the process being stuck in a loop with no recovery option.

Affected Version(s)

microtar 0.1.0

References

https://github.com/rxi/microtar/blob/master/src/microtar....
product
https://github.com/rxi/microtar
product
https://raw.githubusercontent.com/rxi/microtar/master/src...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Saidakbarxon Maxsudxonov
.