CVE-2026-18370

Name of the Vulnerable Software and Affected Versions entr (affected versions not specified)

Description A heap-based buffer overflow exists in the run utility() function. The function allocates a fixed-size heap buffer using malloc(ARG MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string instead of the bytes written. If the buffer is exactly filled, the remaining size underflows as an unsigned size t, leading to out-of-bounds writes. This can be triggered by providing command-line arguments that fill the buffer or by using the / substitution feature, which expands a short token into a longer pathname during runtime. A local attacker can exploit this to cause memory corruption, process abort, and denial of service.

Recommendations Apply the fix provided in commit 2467fe0.