Memory Allocation Vulnerability in GNU cpio by GNU

CVE-2026-66485

What is CVE-2026-66485?

GNU cpio is susceptible to a memory allocation issue in the 'make_path' function, located in src/makepath.c. This function utilizes 'alloca' to allocate stack memory based on the length of 'argpath', which can be influenced by an archive-controlled pathname during the extraction process. If an attacker provides a crafted cpio archive with a lengthy nested pathname, it can lead to unbounded stack allocation, potentially triggering a stack overflow and subsequently crashing the cpio process. A successful exploit allows the attacker to induce a denial of service condition by manipulating the cpio archive, impacting users who attempt to extract it.

References