# CVE-2026-43623: rxi microtar stack buffer overflow in raw_to_header

Source: https://junglewise.ai/threats/cve-2026-43623-rxi-microtar-stack-buffer-overflow-in-raw-to-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-43623 · Severity: high · CVSS 8.8 · Published 2026-06-01

microtar is a lightweight C library used by developers to read and write TAR archives. A security flaw allows a specially crafted TAR file to crash an application or potentially allow an attacker to take control of the system. This occurs when the library processes files with unusually long names that lack proper termination, leading to memory corruption.

Technologies: [Rxi Microtar](https://junglewise.ai/threats/technologies/microtar). Vendors: [Rxi](https://junglewise.ai/threats/vendors/rxi).

## Quick answers

**Is CVE-2026-43623 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43623 being exploited in the wild.

**How severe is CVE-2026-43623?** High severity, with a CVSS score of 8.8, published 1 June 2026.

**Which products and versions are affected?** Rxi Microtar through 0.1.0.

**Is there a fix for CVE-2026-43623?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-43623 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-43623?** Check whether you run Rxi Microtar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in microtar through 0.1.0 within the raw_to_header() function in src/microtar.c. The vulnerability stems from the use of strcpy() to copy 100-byte fixed-width fields (name and linkname) from the raw TAR header into the mtar_header_t struct. Because the POSIX TAR format allows these fields to be non-null-terminated if they occupy the full 100 bytes, strcpy() continues reading into adjacent memory, resulting in a write of up to 355 bytes into a 100-byte destination buffer. An attacker can exploit this by providing a malformed TAR archive to functions like mtar_open(), mtar_find(), or mtar_read_header(), potentially leading to arbitrary code execution. As of the advisory date, the library remains unpatched, though developers are advised to replace strcpy() with bounded memcpy() calls.

## Affected products

- rxi microtar through 0.1.0

## Timeline

- 2026-02-16: disclosed: Initial vulnerability report on GitHub (Issue #28)
- 2026-06-01: advisory: CVE-2026-43623 published by VulnCheck/NVD

## References

- [https://github.com/rxi/microtar/issues/28](https://github.com/rxi/microtar/issues/28)
- [https://github.com/rxi/microtar/issues/29](https://github.com/rxi/microtar/issues/29)
- [https://github.com/rxi/microtar/issues/30](https://github.com/rxi/microtar/issues/30)
- [https://www.vulncheck.com/advisories/microtar-stack-based-buffer-overflow-via-raw-to-header](https://www.vulncheck.com/advisories/microtar-stack-based-buffer-overflow-via-raw-to-header)

## Related threats

- [rxi microtar stack buffer overflow in raw_to_header](https://junglewise.ai/threats/cve-2026-55738-rxi-microtar-stack-buffer-overflow-in-raw-to-header)
- [rxi microtar integer overflow in mtar_next](https://junglewise.ai/threats/cve-2026-54417-rxi-microtar-integer-overflow-in-mtar-next)