CVE-2026-55738: Stack Buffer Overflow in rxi microtar 0.1.0 TAR Parser

Technical summary

The raw_to_header() function in src/microtar.c uses strcpy() to copy the 100-byte name and linkname fields from a TAR header without enforcing null termination. POSIX ustar format allows these fixed-width fields to be completely filled with non-null bytes. When a crafted archive is parsed, a linkname field with no trailing null byte causes strcpy() to read past the 512-byte raw header buffer on the stack and write past the destination buffer. AddressSanitizer confirmed stack-buffer-overflow with READ of size 356 at src/microtar.c:112. The vulnerability affects mtar_open(), mtar_read_header(), and mtar_find() functions.

Business impact

Any application embedding microtar 0.1.0 to process untrusted TAR archives becomes vulnerable to denial of service and potential code execution. This includes backup utilities, archive managers, embedded systems, containerization tools, and any software that parses TAR files from external sources. A successful exploit could lead to service disruption, data confidentiality breaches, or system compromise depending on the privileges of the affected process.

Affected systems

Applications and libraries that depend on rxi microtar 0.1.0 are at risk. Verify your software bill of materials (SBOM) for direct or transitive dependencies on this library. Organizations using microtar in production environments should prioritize identification of all affected deployments. The attack surface is broad because TAR is a ubiquitous archive format, but exploitation requires the application to actively parse a malicious file.

Exploitability

Exploitation requires a remote attacker to supply a crafted TAR archive and the victim to open or parse it. No authentication or special privileges are needed to trigger the vulnerability. The attack is reliable and reproducible. However, delivering the malicious archive to a target and convincing them to parse it may require social engineering or compromised distribution channels. Once triggered, the memory corruption is severe enough to crash the application and potentially execute code depending on heap layout and mitigations.

Remediation

Upgrade to a patched version of microtar beyond 0.1.0. Verify the availability of a fix from the microtar project maintainers. If no patch is available, implement input validation to reject TAR archives with malformed headers or consider switching to a memory-safe parsing library. As an interim measure, restrict TAR file parsing to trusted sources only and run parsing operations with minimal privileges.

Patch guidance

Check the official microtar repository and release notes for availability of a patched version. Apply any released fix as soon as testing confirms compatibility with your application. If you maintain code using microtar, consider integrating safe string handling (e.g., strncpy with explicit null termination) into your fork or evaluation of alternative libraries. Document the version of microtar in use within your build and dependency management systems.

Detection guidance

Monitor for crashes or abnormal termination of applications that parse TAR files, particularly when processing archives from untrusted sources. Stack overflow exploits may trigger SIGSEGV or be caught by memory sanitizers in debug builds. Implement logging of archive parsing operations, including the source and timestamp. Intrusion detection systems can monitor for unusual patterns in file access or process behavior following TAR parsing operations. Review application logs for core dumps or memory violations tied to microtar functions.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.8), the severity of stack buffer overflow exploits, and the ubiquity of TAR archive handling in modern software. Although active exploitation requires user interaction, the barrier to weaponization is low. Organizations should prioritize identifying all uses of microtar 0.1.0 and plan upgrades accordingly. The combination of high impact (confidentiality, integrity, availability) and low complexity makes this a priority for patch management cycles.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible attack vector, low complexity, no privilege requirements, and user interaction as the only limiting factor. The impact on confidentiality, integrity, and availability is high. Stack buffer overflows carry inherent risk of code execution or crash, depending on exploit development and system defenses. Modern protections like ASLR and stack canaries may complicate exploitation but do not eliminate the risk, particularly in embedded or minimally-hardened environments.

Frequently asked questions