Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2026-66485: cpio extraction can crash system with crafted archive
CVE-2026-66485 · published 2 months ago
Summary
The cpio program used on Debian, Ubuntu and other GNU systems can run out of stack memory when it extracts a specially crafted archive containing an extremely long path name. This causes the program to crash, leading to a denial of service for anyone who extracts the malicious archive. Update cpio to the latest version that includes the fix, or avoid extracting untrusted archives.
What to do
- Update canonical cpio to version 2.13+dfsg-7ubuntu0.2.
- Update canonical cpio to version 2.15+dfsg-1ubuntu2.1.
- Update canonical cpio to version 2.15+dfsg-2.1ubuntu0.1.
- Update canonical cpio to version 2.11+dfsg-1ubuntu1.2+esm3.
- Update canonical cpio to version 2.11+dfsg-5ubuntu1.1+esm2.
- Update canonical cpio to version 2.12+dfsg-6ubuntu0.18.04.4+esm1.
- Update canonical cpio to version 2.13+dfsg-2ubuntu0.4+esm1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | cpio | All versions |
| Debian:12 | debian | cpio | All versions |
| Debian:13 | debian | cpio | All versions |
| Debian:14 | debian | cpio | All versions |
| Ubuntu:22.04:LTS | canonical | cpio |
< 2.13+dfsg-7ubuntu0.2 Fix: upgrade to 2.13+dfsg-7ubuntu0.2
|
| Ubuntu:24.04:LTS | canonical | cpio |
< 2.15+dfsg-1ubuntu2.1 Fix: upgrade to 2.15+dfsg-1ubuntu2.1
|
| Ubuntu:26.04:LTS | canonical | cpio |
< 2.15+dfsg-2.1ubuntu0.1 Fix: upgrade to 2.15+dfsg-2.1ubuntu0.1
|
| – | gnu | cpio | <= 2.15 |
| Ubuntu:Pro:14.04:LTS | canonical | cpio |
< 2.11+dfsg-1ubuntu1.2+esm3 Fix: upgrade to 2.11+dfsg-1ubuntu1.2+esm3
|
| Ubuntu:Pro:16.04:LTS | canonical | cpio |
< 2.11+dfsg-5ubuntu1.1+esm2 Fix: upgrade to 2.11+dfsg-5ubuntu1.1+esm2
|
| Ubuntu:Pro:18.04:LTS | canonical | cpio |
< 2.12+dfsg-6ubuntu0.18.04.4+esm1 Fix: upgrade to 2.12+dfsg-6ubuntu0.18.04.4+esm1
|
| Ubuntu:Pro:20.04:LTS | canonical | cpio |
< 2.13+dfsg-2ubuntu0.4+esm1 Fix: upgrade to 2.13+dfsg-2ubuntu0.4+esm1
|
Original advisory text
Uncontrolled Memory Allocation in GNU cpio
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
References
- https://cert.pl/en/posts/2026/08/CVE-2026-66484 Vendor Advisory
- https://git.savannah.gnu.org/cgit/cpio.git Product
- https://security-tracker.debian.org/tracker/CVE-2026-66485 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-66485 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-66485 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8704-1 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66485... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-66485 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-789Memory Allocation with Excessive Size Value
Timeline
Published10 Aug 2026
Updated30 Oct 2026
First seen10 Aug 2026
Sources
CVE-2026-66485 · NVD
CVE-2026-66485 · MITRE
UBUNTU-CVE-2026-66485 · OSV
DEBIAN-CVE-2026-66485 · OSV
CVE-2026-66485 · OSV
Track software like this
Free during beta