CVE-2026-54417CWE-190CWE-835

CVE-2026-54417

High · published June 17, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
54.4
In the wild
Unconfirmed
What it is

An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. mtar_next computes the offset to the next record as round_up(h.size, 512) + sizeof(mtar_raw_header_t) using 32-bit arithmetic.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00750 · 54.4th percentile
Weaknesses
CWE-190 · Integer Overflow or Wraparound; CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2026-06-17T18:17Z
References (3)
https://github.com/rxi/microtar · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/rxi/microtar/blob/master/src/microtar.c#L239 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://raw.githubusercontent.com/rxi/microtar/master/src/microtar.c · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 17 JUN 13:25Z
    Integer Overflow in rxi/microtar mtar_next() Causes Infinite Loop DoS
    cvelistv5