CVE-2026-66485
Fixed in a distro release EPSS <1%CVSS 4.6
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
Products: gnu cpio
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | cpio | no fix |
| Debian 13 | cpio | no fix |
| Debian 14 | cpio | no fix |
| Red Hat hummingbird 1 | cpio | 0:2.15-10.3.hum1 |
| SUSE Linux Enterprise Micro 5.3 | cpio | 2.13-150400.3.10.1 |
| SUSE Linux Enterprise Micro 5.4 | cpio | 2.13-150400.3.10.1 |
| SUSE Linux Enterprise Micro 5.5 | cpio | 2.13-150400.3.10.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | cpio | 2.13-150400.3.10.1 |
| SUSE Linux Enterprise Server 16.0 | cpio | 2.15-160000.3.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | cpio | 2.11-36.25.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | cpio | 2.15-160000.3.1 |
| SUSE Linux Micro 6.0 | cpio | 2.15-2.1 |
| SUSE Linux Micro 6.1 | cpio | 2.15-slfo.1.1_3.1 |
| SUSE Linux Micro 6.2 | cpio | 2.15-160000.3.1 |
| Ubuntu 22.04 LTS | cpio | 2.13+dfsg-7ubuntu0.2 |
| Ubuntu 24.04 LTS | cpio | 2.15+dfsg-1ubuntu2.1 |
| Ubuntu 26.04 LTS | cpio | 2.15+dfsg-2.1ubuntu0.1 |
| Ubuntu Pro 14.04 LTS | cpio | 2.11+dfsg-1ubuntu1.2+esm3 |
| Ubuntu Pro 16.04 LTS | cpio | 2.11+dfsg-5ubuntu1.1+esm2 |
| Ubuntu Pro 18.04 LTS | cpio | 2.12+dfsg-6ubuntu0.18.04.4+esm1 |
| Ubuntu Pro 20.04 LTS | cpio | 2.13+dfsg-2ubuntu0.4+esm1 |
| openSUSE Leap 16.0 | cpio | 2.15-160000.3.1 |
| openSUSE Tumbleweed | cpio | 2.15-8.1 |