CVE-2026-18370: entr Heap Buffer Overflow Vulnerability

CVE-2026-18370 Overview

CVE-2026-18370 is a heap-based buffer overflow [CWE-122] in the run_utility() function of entr, a Unix utility that runs arbitrary commands when files change. The function allocates a fixed-size heap buffer with malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer using the return value of strlcpy(), which reports the source string length rather than bytes actually written. When the buffer fills exactly, the remaining size underflows as an unsigned size_t, and subsequent copies write past the allocation.

Critical Impact
A local attacker can trigger memory corruption, process abort, and denial of service by supplying long argument sequences or abusing the /_ substitution feature.

Affected Products

entr file event utility maintained by Eradman
Builds prior to commit 2467fe0aa5f2b1b074110a9186ef51d35809c9a4
Distributions packaging affected entr releases

Discovery Timeline

2026-08-10 - CVE-2026-18370 published to NVD
2026-08-10 - Last updated in NVD database
Fix committed upstream as 2467fe0

Technical Details for CVE-2026-18370

Vulnerability Analysis

The defect resides in run_utility() inside entr.c. The function reserves a heap region sized to ARG_MAX and iteratively concatenates argument strings using strlcpy(). The BSD-derived strlcpy() returns the length of the source string, which lets callers detect truncation but does not represent bytes written to the destination. The affected code treats the return value as bytes consumed and subtracts it from a remaining counter of type size_t.

When an argument sequence fills the buffer exactly, remaining reaches zero. The next subtraction wraps around to a very large unsigned value, and the loop continues writing well past the end of the allocation. Heap metadata and adjacent allocations become corrupted, producing an abort or exploitable state.

Root Cause

The root cause is a misuse of the strlcpy() contract combined with unchecked arithmetic on an unsigned counter. Advancing the destination pointer by the source length rather than the truncated write length breaks the size accounting. A single boundary-filling input produces a size_t underflow that removes any effective bound on subsequent writes.

Attack Vector

Exploitation requires local access with the ability to invoke entr and control its argument list. An attacker supplies command-line arguments whose combined length equals ARG_MAX, or leverages the /_ substitution feature that expands a short token into a longer runtime pathname. When the substitution grows beyond the reserved space, the heap boundary is crossed.

 	int ret, status;
 	struct timespec delay = { 0, 1000000 };
 	char **new_argv;
-	char *p, *arg_buf;
+	char *p, *arg_buf, *src;
 	int argc;
-	size_t remaining;
+	size_t len, rem;
 
 	if (restart_opt == 1)
 		terminate_utility();
 
-	arg_buf = malloc(ARG_MAX);
+	arg_buf = malloc(rem = ARG_MAX);
+	if (arg_buf == NULL)
+		err(1, "malloc");
 
 	if (shell_opt == 1) {
 		/* run argv[1] with a shell using the leading edge as $0 */

Source: GitHub Commit for Entr. The patch renames the counter to rem, adds a NULL check on malloc, and reworks the copy loop to track bytes written rather than source lengths.

Detection Methods for CVE-2026-18370

Indicators of Compromise

Unexpected SIGABRT or heap corruption crashes originating from entr processes
Core dumps referencing run_utility frames in the call stack
Invocations of entr with unusually long argument lists approaching ARG_MAX
Use of the /_ substitution token with file paths that expand well beyond the input token length

Detection Strategies

Audit process execution telemetry for entr invocations, capturing full command lines and argument counts
Correlate entr crashes reported by the kernel (dmesg, journalctl) with the process telemetry to identify triggering inputs
Package inventory scanning to identify hosts running entr builds without commit 2467fe0

Monitoring Recommendations

Alert on core files or abort signals attributed to entr on multi-user systems
Track shell histories on shared hosts for entr command lines containing /_ and long path substitutions
Feed process and crash logs into a centralized SIEM to correlate repeated failures with the same user context

How to Mitigate CVE-2026-18370

Immediate Actions Required

Upgrade entr to a build that includes upstream commit 2467fe0aa5f2b1b074110a9186ef51d35809c9a4
Rebuild distribution packages from patched source where downstream releases are not yet published
Restrict interactive access on multi-user hosts where entr is installed until patching completes

Patch Information

The upstream fix is available in the GitHub Commit for Entr. Additional advisory context is published by CERT Poland CVE-2026-18370 and the Eradman Project Overview. Rebuild and reinstall entr from a source tree at or beyond that commit.

Workarounds

Avoid the /_ substitution feature on unpatched builds, particularly with long pathnames
Limit entr argument lists so that their combined length is well below ARG_MAX
Remove entr from shared or multi-tenant systems where patching is not immediately possible

bash

# Verify installed entr includes the fix
entr -h 2>&1 | head -n 1
git -C /path/to/entr log --oneline | grep 2467fe0