Executive brief
GNU cpio is an archive extraction utility used to decompress and extract files from cpio archives. A specially crafted cpio archive with an extremely long nested pathname can cause the utility to allocate excessive stack memory, crashing the process and preventing file extraction. An attacker can exploit this by distributing a malicious archive that causes denial of service when extracted.
Technical details
The vulnerability is a memory allocation issue (CWE-789) in the make_path function at src/makepath.c. The function uses alloca() to allocate stack memory based on the length of argpath, a field derived from archive-controlled pathnames during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes unbounded stack allocation, resulting in stack overflow and process crash. This affects cpio versions through 2.15. The attack requires only that a victim extract a crafted archive; no authentication or network access is required. The vulnerability has been fixed in the repository and a patch is available.
Affected products
- GNU cpio through 2.15
Timeline
- 2026-08-10: disclosed
- 2026-08-28: patched: Fix merged in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9