Vulnerability · Published Jun 17, 2026 · Assigned by TuranSec
CVE-2026-55738Stack Buffer Overflow in rxi/microtar raw_to_header() via non-null-terminated TAR name field
High 8.8
In plain English
A high-severity stack buffer overflow in microtar from rxi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 65.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A stack-based buffer overflow exists in the raw_to_header function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy without guaranteeing null termination of the source.
Affected products (as reported)
Weakness: CWE-121, CWE-170 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/rxi/microtar/blob/master/src/microtar.c#L111 product
- https://github.com/rxi/microtar product
- Vulnerable source code: src/microtar.c (raw_to_header) technical-description