Executive brief
rxi microtar is a lightweight C library used for reading and writing tar archives. A flaw in how the library calculates file positions allows a specially crafted archive to trigger an infinite loop. This can cause applications using the library to hang and consume 100% of the CPU, leading to a total denial of service.
Technical details
An integer overflow exists in the mtar_next() function within src/microtar.c of rxi microtar 0.1.0. The function calculates the offset to the next record using 32-bit arithmetic: round_up(h.size, 512) + sizeof(mtar_raw_header_t). If a crafted tar header specifies a size that, when rounded and added to the header size, results in a 32-bit integer wrap-around to zero (specifically sizes in the range 0xFFFFFC01-0xFFFFFE00), the library seeks to the current record position instead of advancing. This causes mtar_find() or any iteration loop to repeat indefinitely, resulting in 100% CPU consumption and a process hang. The vulnerability can be triggered by any application that parses untrusted tar files using this library.
Affected products
- rxi microtar 0.1.0
Timeline
- 2026-06-17: advisory: NVD publication date