USN-8704-1: cpio Ubuntu

Vulnerability summary

USN-8704-1 is a vulnerability in cpio Ubuntu with no CVSS score yet.

Timeline

1. 31-08-2026
   PublishedVulnerability first disclosed.
2. 01-09-2026
   Last modifiedVulnerability information updated.

Description

cpio vulnerabilities It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the extraction directory, even when using the --no-absolute-filenames option. (CVE-2026-66484) It was discovered that cpio did not properly bound the stack memory allocated for pathnames during archive extraction. If a user or automated system were tricked into extracting a specially crafted cpio archive, an attacker could possibly use this issue to cause cpio to crash, resulting in a denial of service. (CVE-2026-66485) It was discovered that cpio did not properly escape archive member names when listing archive contents. If a user or automated system were tricked into listing a specially crafted archive, an attacker could possibly use this issue to inject misleading output or malicious terminal control sequences. (CVE-2026-66486)

No weakness data has been published for this record.