{"id":"CVE-2026-126831","aliases":["EUVD-2026-124565","GHSA-ffxh-f67m-r64f","UBUNTU-CVE-2026-126831"],"status":"published","title":"Cpio: cpio: stack-based buffer overflow in write_out_tar_header() with long usernames/groupnames","description":"A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-13","score":0.00105,"percentile":0.0109,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-121"],"published":"2026-11-12T17:27:16Z","modified":"2026-11-13T21:05:35Z","affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11+dfsg-1ubuntu1","2.11+dfsg-1ubuntu1.1","2.11+dfsg-1ubuntu1.2","2.11+dfsg-1ubuntu1.2+esm1","2.11+dfsg-1ubuntu1.2+esm2","2.11+dfsg-1ubuntu1.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11+dfsg-4.1ubuntu1","2.11+dfsg-5ubuntu1","2.11+dfsg-5ubuntu1.1","2.11+dfsg-5ubuntu1.1+esm1","2.11+dfsg-5ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11+dfsg-6","2.12+dfsg-6","2.12+dfsg-6ubuntu0.18.04.1","2.12+dfsg-6ubuntu0.18.04.4","2.12+dfsg-6ubuntu0.18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12+dfsg-9","2.12+dfsg-9ubuntu1","2.13+dfsg-1","2.13+dfsg-2","2.13+dfsg-2ubuntu0.3","2.13+dfsg-2ubuntu0.4","2.13+dfsg-2ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.13+dfsg-4ubuntu4","2.13+dfsg-7","2.13+dfsg-7ubuntu0.1","2.13+dfsg-7ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.13+dfsg-7.1","2.14+dfsg-1","2.15+dfsg-1","2.15+dfsg-1ubuntu1","2.15+dfsg-1ubuntu2","2.15+dfsg-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.15+dfsg-2.1","2.15+dfsg-2.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.15+dfsg-2ubuntu1","2.15+dfsg-2.1","2.15+dfsg-2.1ubuntu0.1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-126831","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571893","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126831"},{"url":"https://github.com/advisories/GHSA-ffxh-f67m-r64f"},{"url":"https://ubuntu.com/security/CVE-2026-126831","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-126831","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-126831","title":"Cpio: cpio: stack-based buffer overflow in write_out_tar_header() with long usernames/groupnames","description":"A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash.","status":"published","published":"2026-11-12T17:27:16.588Z","modified":"2026-11-13T15:40:46.559Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-12T18:46:15.330302Z"}],"euvd":[{"id":"EUVD-2026-124565","description":"A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash.","status":"published","published":"2026-11-12T17:27:16Z","modified":"2026-11-13T15:40:46Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-12T20:34:58.221926Z"}],"ghsa":[{"id":"GHSA-ffxh-f67m-r64f","title":"A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack...","description":"A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash.","status":"published","published":"2026-11-12T18:31:54Z","modified":"2026-11-12T18:32:03Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-12T18:42:37.941061Z"}],"nvd":[{"id":"CVE-2026-126831","description":"A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash.","status":"published","published":"2026-11-12T18:17:28.583Z","modified":"2026-11-13T16:18:46.613Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-13T17:36:48.454406Z"}],"osv":[{"id":"UBUNTU-CVE-2026-126831","description":"A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash.","status":"published","published":"2026-11-13T00:00:00Z","modified":"2026-11-13T21:05:35.594321272Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-13T21:30:20.292037Z"}]}}