{"id":"CVE-2026-66485","aliases":["AZL-94692","CLSA-2026-1787310466","CLSA-2026-1787337004","DEBIAN-CVE-2026-66485","EUVD-2026-55255","GHSA-mmw4-f4p6-w77q","MGASA-2026-0435","OESA-2026-3456","RHSA-2026:82414","SUSE-SU-2026:23355-1","SUSE-SU-2026:23441-1","SUSE-SU-2026:23464-1","SUSE-SU-2026:23612-1","SUSE-SU-2026:3959-1","SUSE-SU-2026:4012-1","UBUNTU-CVE-2026-66485","USN-8704-1","openSUSE-SU-2026:11618-1","openSUSE-SU-2026:21747-1"],"status":"published","title":"Uncontrolled Memory Allocation in GNU cpio","description":"GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.\n\nThis issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9","severity":{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00185,"percentile":0.08234,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-789"],"published":"2026-08-10T10:25:34Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"cpio","fixed_in":["2.14-2"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"cpio","fixed_in":["0:2.15-10.3.hum1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cpio","fixed_in":["2.11+dfsg-1ubuntu1.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cpio","fixed_in":["2.11+dfsg-5ubuntu1.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cpio","fixed_in":["2.12+dfsg-6ubuntu0.18.04.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cpio","fixed_in":["2.13+dfsg-2ubuntu0.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"cpio","fixed_in":["2.13+dfsg-7ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"cpio","fixed_in":["2.15+dfsg-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"cpio","fixed_in":["2.15+dfsg-2.1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-16.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-16.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.13+dfsg-7.1","2.14+dfsg-1","2.15+dfsg-1","2.15+dfsg-2","2.15+dfsg-2.1"]},{"source":"osv","ecosystem":"Debian:13","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.15+dfsg-2","2.15+dfsg-2.1"]},{"source":"osv","ecosystem":"Debian:14","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.15+dfsg-2","2.15+dfsg-2.1"]},{"source":"osv","ecosystem":"Mageia:10","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-3.1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-1.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-9.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-12.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-5.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-5.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-5.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15-10.3.hum1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-slfo.1.1_3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-1ubuntu1.2+esm3"}]}],"versions":["2.11+dfsg-1ubuntu1","2.11+dfsg-1ubuntu1.1","2.11+dfsg-1ubuntu1.2","2.11+dfsg-1ubuntu1.2+esm1","2.11+dfsg-1ubuntu1.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-5ubuntu1.1+esm2"}]}],"versions":["2.11+dfsg-4.1ubuntu1","2.11+dfsg-5ubuntu1","2.11+dfsg-5ubuntu1.1","2.11+dfsg-5ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12+dfsg-6ubuntu0.18.04.4+esm1"}]}],"versions":["2.11+dfsg-6","2.12+dfsg-6","2.12+dfsg-6ubuntu0.18.04.1","2.12+dfsg-6ubuntu0.18.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-2ubuntu0.4+esm1"}]}],"versions":["2.12+dfsg-9","2.12+dfsg-9ubuntu1","2.13+dfsg-1","2.13+dfsg-2","2.13+dfsg-2ubuntu0.3","2.13+dfsg-2ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-7ubuntu0.2"}]}],"versions":["2.13+dfsg-4ubuntu4","2.13+dfsg-7","2.13+dfsg-7ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15+dfsg-1ubuntu2.1"}]}],"versions":["2.13+dfsg-7.1","2.14+dfsg-1","2.15+dfsg-1","2.15+dfsg-1ubuntu1","2.15+dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15+dfsg-2.1ubuntu0.1"}]}],"versions":["2.15+dfsg-2ubuntu1","2.15+dfsg-2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-1ubuntu1.2+esm3"}]}],"versions":["2.11+dfsg-1ubuntu1","2.11+dfsg-1ubuntu1.1","2.11+dfsg-1ubuntu1.2","2.11+dfsg-1ubuntu1.2+esm1","2.11+dfsg-1ubuntu1.2+esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-5ubuntu1.1+esm2"}]}],"versions":["2.11+dfsg-4.1ubuntu1","2.11+dfsg-5ubuntu1","2.11+dfsg-5ubuntu1.1","2.11+dfsg-5ubuntu1.1+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12+dfsg-6ubuntu0.18.04.4+esm1"}]}],"versions":["2.11+dfsg-6","2.12+dfsg-6","2.12+dfsg-6ubuntu0.18.04.1","2.12+dfsg-6ubuntu0.18.04.4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-2ubuntu0.4+esm1"}]}],"versions":["2.12+dfsg-9","2.12+dfsg-9ubuntu1","2.13+dfsg-1","2.13+dfsg-2","2.13+dfsg-2ubuntu0.3","2.13+dfsg-2ubuntu0.4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-7ubuntu0.2"}]}],"versions":["2.13+dfsg-4ubuntu4","2.13+dfsg-7","2.13+dfsg-7ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15+dfsg-1ubuntu2.1"}]}],"versions":["2.13+dfsg-7.1","2.14+dfsg-1","2.15+dfsg-1","2.15+dfsg-1ubuntu1","2.15+dfsg-1ubuntu2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15+dfsg-2.1ubuntu0.1"}]}],"versions":["2.15+dfsg-2ubuntu1","2.15+dfsg-2.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-160000.3.1"}]}],"bundled":3}],"products":[{"vendor":"gnu","product":"cpio"},{"vendor":"red hat","product":"cpio"}],"references":[{"url":"https://cert.pl/en/posts/2026/08/CVE-2026-66484","tags":["third-party-advisory","advisory","article","report"]},{"url":"https://git.savannah.gnu.org/cgit/cpio.git","tags":["product","package","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66485","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-mmw4-f4p6-w77q"},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787310466.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66486","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1787337004.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66485.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-66485","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0435.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36242","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8704-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3456","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66484","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82414","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-66485","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82414.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2513083","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66485","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623355-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1274856","tags":["report"]},{"url":"https://bugzilla.suse.com/1274857","tags":["report"]},{"url":"https://bugzilla.suse.com/1274858","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66486","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623441-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221712","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623464-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623612-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263959-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264012-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-66485","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-66484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-66486","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-66485","title":"Uncontrolled Memory Allocation in GNU cpio","description":"GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.\n\nThis issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9","status":"published","published":"2026-08-10T10:25:34.337Z","modified":"2026-08-10T10:56:56.427Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:20:12.939084Z"}],"euvd":[{"id":"EUVD-2026-55255","description":"GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.\n\nThis issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9","status":"published","published":"2026-08-10T10:25:34Z","modified":"2026-08-10T10:56:56Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:06.086083Z"}],"ghsa":[{"id":"GHSA-mmw4-f4p6-w77q","title":"GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src...","description":"GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.\n\nThis issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9","status":"published","published":"2026-08-10T12:31:50Z","modified":"2026-08-10T12:31:54Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:10:13.54571Z"}],"nvd":[{"id":"CVE-2026-66485","description":"GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.\n\nThis issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9","status":"published","published":"2026-08-10T11:17:27.773Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:12:35.743275Z"}],"osv":[{"id":"CVE-2026-66485","title":"Uncontrolled Memory Allocation in GNU cpio","description":"GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.\n\nThis issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9","status":"published","published":"2026-08-10T10:25:34.337Z","modified":"2026-10-25T02:30:58.003996309Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"DEBIAN-CVE-2026-66485","description":"GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.  This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9","status":"published","published":"2026-08-10T11:17:27.773Z","modified":"2026-10-25T09:47:29.246316741Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"OESA-2026-3456","title":"cpio security update","description":"GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe.\r\n\r\nSecurity Fix(es):\n\nGNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files.\n\nThis issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad(CVE-2026-66484)\n\nGNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.\n\nThis issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9(CVE-2026-66485)","status":"published","published":"2026-08-20T10:00:01Z","modified":"2026-08-20T10:15:12.812708563Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RHSA-2026:82414","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-14T10:32:50Z","modified":"2026-10-14T10:48:13.468329879Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-66485","description":"GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9","status":"published","published":"2026-08-10T11:17:00Z","modified":"2026-09-01T15:47:52.105294575Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"AZL-94692","title":"CVE-2026-66485 affecting package cpio for versions less than 2.14-2","description":"GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.\n\nThis issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9","status":"published","published":"2026-08-10T11:17:27Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"CLSA-2026-1787310466","title":"cpio: Fix of 2 CVEs","description":"- CVE-2026-66485: avoid stack exhaustion from archive-controlled paths\n- CVE-2026-66486: quote file names in diagnostics and listings","status":"published","published":"2026-08-21T11:08:04Z","modified":"2026-10-26T09:31:28.906636276Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787337004","title":"cpio: Fix of 2 CVEs","description":"- CVE-2026-66485: avoid stack exhaustion from archive-controlled paths\n- CVE-2026-66486: quote file names in diagnostics and listings","status":"published","published":"2026-08-21T18:30:16Z","modified":"2026-10-26T09:30:37.698699332Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"MGASA-2026-0435","title":"Updated cpio packages fix security vulnerabilities","description":"Path Traversal in GNU cpio. (CVE-2026-66484)\nUncontrolled Memory Allocation in GNU cpio. (CVE-2026-66485)\nImproper Output Encoding in GNU cpio. (CVE-2026-66486)\n","status":"published","published":"2026-09-23T01:45:55Z","modified":"2026-09-23T02:00:08.323135269Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11618-1","title":"cpio-2.15-8.1 on GA media","description":"These are all security issues fixed in the cpio-2.15-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-27T00:00:00Z","modified":"2026-08-28T18:23:08.633900665Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21747-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard\n  links outside intended directory via malicious tar archives (bsc#1274856).\n- CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of\n  service via crafted archives (bsc#1274857).\n- CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for\n  terminal control sequence injection via crafted archive member names (bsc#1274858).\n","status":"published","published":"2026-09-03T14:47:52Z","modified":"2026-09-09T18:23:13.642681083Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23355-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard\n  links outside intended directory via malicious tar archives (bsc#1274856).\n- CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of\n  service via crafted archives (bsc#1274857).\n- CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for\n  terminal control sequence injection via crafted archive member names (bsc#1274858).\n","status":"published","published":"2026-08-28T11:00:05Z","modified":"2026-09-10T18:23:12.505259654Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23441-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard\n  links outside intended directory via malicious tar archives (bsc#1274856).\n- CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of\n  service via crafted archives (bsc#1274857).\n- CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for\n  terminal control sequence injection via crafted archive member names (bsc#1274858).\n\nNon security issue fixed:\n\n- GCC 14: cpio package fails (bsc#1221712).\n\n","status":"published","published":"2026-08-31T19:29:34Z","modified":"2026-09-14T18:23:11.006889794Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23464-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard\n  links outside intended directory via malicious tar archives (bsc#1274856).\n- CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of\n  service via crafted archives (bsc#1274857).\n- CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for\n  terminal control sequence injection via crafted archive member names (bsc#1274858).\n","status":"published","published":"2026-09-03T14:49:10Z","modified":"2026-09-14T18:23:12.172147103Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23612-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard\n  links outside intended directory via malicious tar archives (bsc#1274856).\n- CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of\n  service via crafted archives (bsc#1274857).\n- CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for\n  terminal control sequence injection via crafted archive member names (bsc#1274858).\n","status":"published","published":"2026-09-03T14:49:10Z","modified":"2026-09-29T18:23:19.208734127Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3959-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2026-66484: path traversal allows creating hard links outside intended directory via malicious tar archives\n  (bsc#1274856).\n- CVE-2026-66485: denial of service via uncontrolled memory allocation from crafted archives (bsc#1274857).\n- CVE-2026-66486: terminal control sequence injection via crafted archive member names (bsc#1274858).\n","status":"published","published":"2026-09-03T13:32:22Z","modified":"2026-09-13T18:23:12.437666635Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4012-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard\n  links outside intended directory via malicious tar archives (bsc#1274856).\n- CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of\n  service via crafted archives (bsc#1274857).\n- CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for\n  terminal control sequence injection via crafted archive member names (bsc#1274858).\n","status":"published","published":"2026-09-07T07:34:54Z","modified":"2026-09-13T18:23:15.156312136Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8704-1","title":"cpio vulnerabilities","description":"It was discovered that cpio incorrectly sanitized hard-link targets when\nextracting tar archives in copy-in mode. If a user or automated system\nwere tricked into extracting a specially crafted tar archive, an attacker\ncould possibly use this issue to create hard links to files outside the\nextraction directory, even when using the --no-absolute-filenames option.\n(CVE-2026-66484)\n\nIt was discovered that cpio did not properly bound the stack memory\nallocated for pathnames during archive extraction. If a user or automated\nsystem were tricked into extracting a specially crafted cpio archive, an\nattacker could possibly use this issue to cause cpio to crash, resulting\nin a denial of service. (CVE-2026-66485)\n\nIt was discovered that cpio did not properly escape archive member names\nwhen listing archive contents. If a user or automated system were tricked\ninto listing a specially crafted archive, an attacker could possibly use\nthis issue to inject misleading output or malicious terminal control\nsequences. (CVE-2026-66486)","status":"published","published":"2026-08-31T13:12:09Z","modified":"2026-09-01T15:56:17.78869085Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}