Stack-Based Buffer Overflow in rxi Microtar TAR Archive Handling

CVE-2026-55738

What is CVE-2026-55738?

A stack-based buffer overflow exists in the raw_to_header() function of rxi microtar 0.1.0. The vulnerability arises when the library processes TAR archive headers using strcpy() to copy fixed-width fields without ensuring proper null termination. This occurs in the context of the POSIX ustar format, where a maliciously crafted TAR archive can exploit this oversight. If the linkname field in the TAR header contains no null terminator, it leads to an out-of-bounds read and write, potentially allowing remote attackers to crash the application or execute arbitrary code when a victim opens or interacts with the affected archive functions.

References