Log in Start free

Vulnerability · Published Aug 10, 2026 · Assigned by CERT-PL

CVE-2026-66486Improper Output Encoding in GNU cpio

Medium 4.6

In plain English

A medium-severity security flaw in cpio from GNU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)4.6Medium
Exploit odds (30 days)0.2%top 91.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12cpiono fix listedDEBIAN-CVE-2026-66486
Debian:13cpiono fix listedDEBIAN-CVE-2026-66486
Debian:14cpiono fix listedDEBIAN-CVE-2026-66486
Ubuntu:22.04:LTScpio2.13+dfsg-7ubuntu0.2UBUNTU-CVE-2026-66486
Ubuntu:22.04:LTScpio2.13+dfsg-7ubuntu0.2USN-8704-1
Ubuntu:24.04:LTScpio2.15+dfsg-1ubuntu2.1USN-8704-1
Ubuntu:24.04:LTScpio2.15+dfsg-1ubuntu2.1UBUNTU-CVE-2026-66486
Ubuntu:26.04:LTScpio2.15+dfsg-2.1ubuntu0.1USN-8704-1
Ubuntu:26.04:LTScpio2.15+dfsg-2.1ubuntu0.1UBUNTU-CVE-2026-66486

Affected products (as reported)

VendorProductVersions
GNU cpio 0 – through 2.15

Weakness: CWE-116 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References