# CVE-2026-126831: cpio stack-based buffer overflow in tar header

Source: https://junglewise.ai/threats/cve-2026-126831-a-flaw-was-found-in-cpio-a-local-user-can-cause-a-denial-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126831 · Severity: medium · CVSS 5.5 · Published 2026-11-12

cpio is a utility used to create and extract file archives. A local attacker can crash cpio when archiving files owned by users or groups with names longer than 32 characters, causing a denial of service. This vulnerability cannot be exploited remotely and requires local access to the system.

Technologies: [Gnu Cpio](https://junglewise.ai/threats/technologies/cpio). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-126831 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126831 being exploited in the wild.

**How severe is CVE-2026-126831?** Medium severity, with a CVSS score of 5.5, published 12 November 2026.

**Which products and versions are affected?** GNU cpio.

**Is there a fix for CVE-2026-126831?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-126831 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-126831?** Check whether you run Gnu Cpio. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in cpio's write_out_tar_header() function when processing tar or ustar archive formats. The vulnerability occurs because cpio copies user and group names into fixed 32-character buffers without length validation, allowing an attacker with local access to corrupt stack memory and crash the application. This is a CWE-121 stack-based buffer overflow with local attack vector and low privilege requirements.

## Affected products

- GNU cpio

## Timeline

- 2026-11-12: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-126831](https://access.redhat.com/security/cve/CVE-2026-126831)

## Related threats

- [GNU cpio improper encoding of archive listing output](https://junglewise.ai/threats/cve-2026-66486-gnu-cpio-improper-encoding-of-archive-listing-output)
- [GNU cpio uncontrolled stack memory allocation in make_path](https://junglewise.ai/threats/cve-2026-66485-gnu-cpio-uncontrolled-stack-memory-allocation-in-make-path)
- [GNU cpio path traversal in tar hard-link extraction](https://junglewise.ai/threats/cve-2026-66484-gnu-cpio-path-traversal-in-tar-hard-link-extraction)
- [GNU cpio insecure file permissions via 0 umask in archive creation](https://junglewise.ai/threats/cve-1999-1572-gnu-cpio-insecure-file-permissions-via-0-umask-in-archive-creation)