Quick answers
- Is CVE-2026-66485 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66485 being exploited in the wild.
- How severe is CVE-2026-66485?
- Informational severity, with a CVSS score of 5.5, published 10 August 2026.
- Which products and versions are affected?
- Gnu Cpio through 2.15.
- Is there a fix for CVE-2026-66485?
- A patch was published on 2026-08-28: Fix merged in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-66485 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-66485?
- Check whether you run Gnu Cpio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a memory allocation issue (CWE-789) in the make_path function at src/makepath.c. The function uses alloca() to allocate stack memory based on the length of argpath, a field derived from archive-controlled pathnames during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes unbounded stack allocation, resulting in stack overflow and process crash. This affects cpio versions through 2.15. The attack requires only that a victim extract a crafted archive; no authentication or network access is required. The vulnerability has been fixed in the repository and a patch is available.
Affected products
- GNU cpio through 2.15
Timeline
- 2026-08-10: disclosed
- 2026-08-28: patched: Fix merged in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9