CVE-2026-66485: gnu cpio

Vulnerability summary

CVE-2026-66485 is a medium (CVSS 4.6) vulnerability in gnu cpio. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.5% of scored vulnerabilities.

Timeline

1. 10-08-2026
   PublishedVulnerability first disclosed.
2. 10-08-2026
   Last modifiedVulnerability information updated.

Description

GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9

• CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.