CVE-2026-66485

Name of the Vulnerable Software and Affected Versions GNU cpio (affected versions not specified)

Description An uncontrolled memory allocation exists in the make path() function within src/makepath.c. The function utilizes alloca to allocate stack memory based on the length of the argpath variable, which is derived from a pathname controlled by the archive during extraction. A crafted cpio archive containing an excessively long nested pathname can trigger an unbounded stack allocation, leading to a stack overflow and a process crash, which results in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.