CVE-2026-71267: microtar Buffer Overflow Vulnerability

CVE-2026-71267 Overview

CVE-2026-71267 is a stack buffer overflow [CWE-121] in the microtar library, a small C library for reading and writing tar files. The vulnerability resides in the mtar_write_file_header() and mtar_write_dir_header() functions in src/microtar.c. Both functions copy a caller-supplied entry name into the 100-byte name field of a stack-allocated mtar_header_t structure using strcpy(h.name, name). The code performs no bounds check against strlen(name) before the copy. Any application that passes an externally-influenced filename longer than 99 characters triggers the overflow.

Critical Impact
A remote attacker who can influence archive entry names can corrupt the stack and potentially achieve arbitrary code execution in any process linking microtar.

Affected Products

microtar library (src/microtar.c) — upstream repository rxi/microtar
Applications that link microtar and call mtar_write_file_header() with untrusted input
Applications that link microtar and call mtar_write_dir_header() with untrusted input

Discovery Timeline

2026-08-05 - CVE-2026-71267 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71267

Vulnerability Analysis

The microtar library defines mtar_header_t with a fixed 100-byte name member, matching the classic POSIX tar header layout. When callers invoke mtar_write_file_header() or mtar_write_dir_header(), the library copies the supplied filename into this field with strcpy(). The strcpy() function terminates only when it reaches a null byte in the source string. A filename of 100 bytes or more writes past the end of the name field into adjacent stack memory, including saved frame pointers and return addresses.

An attacker who controls the filename argument can craft input that overwrites the return address. Depending on the host binary's compiler flags, this leads to arbitrary code execution, denial of service through crash, or memory corruption that alters subsequent archive operations. The vulnerability is exploitable over the network wherever an application accepts attacker-controlled filenames and archives them with microtar.

Root Cause

The root cause is the absence of a length check before strcpy(h.name, name). The tar format restricts filenames to 100 bytes, but microtar trusts the caller to enforce this constraint rather than validating input at the library boundary. Bounded copy primitives such as strncpy() or snprintf() would prevent the overwrite.

Attack Vector

Exploitation requires the attacker to supply a filename longer than 99 characters to a program that forwards it to the vulnerable functions. Typical scenarios include file upload endpoints that archive user submissions, backup utilities that ingest directory listings from network shares, and firmware update tools that package attacker-influenced paths. No authentication or user interaction is required when the calling application exposes archive creation over the network.

Refer to the microtar source in the upstream repository for the exact call sites of the unbounded strcpy().

Detection Methods for CVE-2026-71267

Indicators of Compromise

Process crashes or abnormal terminations in applications that call microtar during archive creation with attacker-influenced filenames
Stack canary violation messages in system logs from binaries linking microtar
Unusual child processes spawned by services that perform tar packaging of user-supplied content
Archive files with entries whose declared filename length approaches or exceeds 100 bytes

Detection Strategies

Perform static analysis of dependent codebases to locate calls to mtar_write_file_header() and mtar_write_dir_header() and verify each caller enforces a 99-byte filename limit
Deploy runtime memory-safety instrumentation such as AddressSanitizer in test environments to catch the overflow during fuzzing
Inspect network-facing services that accept filenames and archive them, and log any input exceeding 99 characters

Monitoring Recommendations

Alert on repeated segmentation faults or stack protector aborts in processes known to use microtar
Monitor for anomalous outbound connections from services that perform archive creation, which may indicate post-exploitation activity
Enable EDR telemetry on file archiving workflows to capture command-line arguments and child-process creation

How to Mitigate CVE-2026-71267

Immediate Actions Required

Inventory all applications and container images that link microtar and identify network-reachable code paths that pass untrusted filenames to the affected functions
Enforce a strict 99-byte maximum on filename input at the application layer before calling microtar
Rebuild binaries linking microtar with stack protector (-fstack-protector-strong), position-independent execution (-fPIE -pie), and FORTIFY_SOURCE where supported

Patch Information

No official patched release is referenced in the NVD record at publication time. Consult the microtar upstream repository for the latest commits addressing the unbounded strcpy() in mtar_write_file_header() and mtar_write_dir_header(). Downstream maintainers should replace the affected strcpy() calls with a bounded copy that returns an error when input exceeds 99 bytes.

Workarounds

Validate and truncate or reject any filename longer than 99 characters before it reaches the microtar API
Wrap calls to mtar_write_file_header() and mtar_write_dir_header() in a sanitizing helper that enforces the length constraint centrally
Isolate archive-creation logic in a sandboxed process with seccomp filters and minimal filesystem privileges to contain any successful exploitation

bash

# Configuration example: enforce filename length at the application boundary
# Reject archive requests containing filenames longer than 99 bytes
if [ ${#FILENAME} -ge 100 ]; then
  echo "error: filename exceeds microtar 99-byte limit" >&2
  exit 1
fi