What is CVE-2026-66485?
A critical vulnerability in GNU cpio allows uncontrolled memory allocation in the `make_path` function based on an archive-controlled pathname length. This can lead to stack overflow via `alloca` during extraction. To mitigate, avoid extracting archives from untrusted sources until a patch is available.
Azərbaycanca: GNU cpio utilitində kritik zəiflik aşkarlanıb: `make_path` funksiyası arxivdən gələn yol uzunluğuna əsaslanaraq nəzarətsiz yaddaş ayırır. Bu, `alloca` vasitəsilə stack yaddaşını aşmağa imkan verir. Təhlükəsizlik üçün arxiv çıxarışı zamanı etibarsız mənbələrdən gələn fayllardan istifadə etmək məhdudlaşdırılmalıdır.
Related CVEs
link basis: same weakness class CWE-119; shared vendor: GNU
FAQ2
How does CVE-2026-66485 affect the GNU cpio utility?
This vulnerability causes uncontrolled memory allocation in the `make_path` function. Since it relies on an archive-controlled pathname length, it can lead to a stack overflow via `alloca` during extraction.
What mitigation is advised for CVE-2026-66485?
Until a patch is available, avoid extracting archives from untrusted sources.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.