Executive brief
microtar is a lightweight C library used by developers to read and write TAR archives. A security flaw allows a specially crafted TAR file to crash an application or potentially allow an attacker to take control of the system. This occurs when the library processes files with unusually long names that lack proper termination, leading to memory corruption.
Technical details
A stack-based buffer overflow exists in microtar through 0.1.0 within the raw_to_header() function in src/microtar.c. The vulnerability stems from the use of strcpy() to copy 100-byte fixed-width fields (name and linkname) from the raw TAR header into the mtar_header_t struct. Because the POSIX TAR format allows these fields to be non-null-terminated if they occupy the full 100 bytes, strcpy() continues reading into adjacent memory, resulting in a write of up to 355 bytes into a 100-byte destination buffer. An attacker can exploit this by providing a malformed TAR archive to functions like mtar_open(), mtar_find(), or mtar_read_header(), potentially leading to arbitrary code execution. As of the advisory date, the library remains unpatched, though developers are advised to replace strcpy() with bounded memcpy() calls.
Affected products
- rxi microtar through 0.1.0
Timeline
- 2026-02-16: disclosed: Initial vulnerability report on GitHub (Issue #28)
- 2026-06-01: advisory: CVE-2026-43623 published by VulnCheck/NVD