CVE-2026-55738CWE-121CWE-170

CVE-2026-55738

High · published June 17, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

A stack-based buffer overflow exists in the raw_to_header function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy without guaranteeing null termination of the source.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00554 · 45.5th percentile
Weaknesses
CWE-121 · Stack-based Buffer Overflow; CWE-170 · Improper Null Termination
Published
2026-06-17T18:18Z
References (3)
https://github.com/rxi/microtar · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/rxi/microtar/blob/master/src/microtar.c#L111 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://raw.githubusercontent.com/rxi/microtar/master/src/microtar.c · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 17 JUN 13:45Z
    Stack Buffer Overflow in rxi/microtar raw_to_header() via non-null-terminated TAR name field
    cvelistv5