Executive brief
CorvusSKK is a Japanese language input tool. An integer overflow vulnerability in how it processes tar archive file sizes allows an attacker to write malicious data to legitimate dictionary files, potentially corrupting or compromising the integrity of user language data and system functionality.
Technical details
The vulnerability is an integer overflow (CWE-190) in the handling of signed 32-bit file sizes when processing tar archives. An attacker can craft a malicious tar file with an oversized file size field that overflows the signed 32-bit integer, causing the application to write arbitrary data to dictionary files. The attack requires local access and user interaction (user must open/process the malicious tar file). The vulnerability was patched in version 3.3.4 by correcting the integer overflow condition in tar file size processing.
Affected products
- SASAKI Nobuyuki CorvusSKK prior to 3.3.4
Timeline
- 2026-08-26: disclosed: CVE-2026-76149 published
- 2026-08-14: patched: CorvusSKK 3.3.4 released with fix for signed 32-bit integer overflow in tar file size handling