CVE catalog

CVE-2026-66485

GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is deri

[CVE catalog]

Severity
Medium · CVSS 5CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.18% · Oct 25, 2026

GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancpiosid2.15+dfsg-2.1vulnerable
Debiancpioforky2.15+dfsg-2.1vulnerable
Debiancpiotrixie2.15+dfsg-2vulnerable
Debiancpiobookworm2.13+dfsg-7.1vulnerable
Ubuntucpionoble2.15+dfsg-1ubuntu2.1fixed
Ubuntucpiopro2.12+dfsg-9vulnerable
Ubuntucpiopro2.12+dfsg-9ubuntu1vulnerable
Ubuntucpiopro2.13+dfsg-1vulnerable
Ubuntucpiopro2.13+dfsg-2vulnerable
Ubuntucpiopro2.13+dfsg-2ubuntu0.3vulnerable
Ubuntucpiopro2.13+dfsg-2ubuntu0.4vulnerable
Ubuntucpiopro2.13+dfsg-2ubuntu0.4+esm1fixed
Ubuntucpio22.042.13+dfsg-4ubuntu4vulnerable
Ubuntucpio22.042.13+dfsg-7vulnerable
Ubuntucpio22.042.13+dfsg-7ubuntu0.1vulnerable
Ubuntucpio22.042.13+dfsg-7ubuntu0.2fixed
Ubuntucpio24.042.13+dfsg-7.1vulnerable
Ubuntucpio24.042.14+dfsg-1vulnerable
Ubuntucpio24.042.15+dfsg-1vulnerable
Ubuntucpio24.042.15+dfsg-1ubuntu1vulnerable
Ubuntucpio24.042.15+dfsg-1ubuntu2vulnerable
Ubuntucpio24.042.15+dfsg-1ubuntu2.1fixed
Ubuntucpio26.042.15+dfsg-2ubuntu1vulnerable
Ubuntucpio26.042.15+dfsg-2.1vulnerable
Ubuntucpio26.042.15+dfsg-2.1ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancpiosourcesid(unfixed)not yet assignedNot reported[1144387]
Debiancpiosourceforky(unfixed)not yet assignedNot reported[1144387]
Debiancpiosourcetrixie(unfixed)not yet assignedNot reported[1144387]
Debiancpiosourcebookworm(unfixed)not yet assignedNot reported[1144387]
Ubuntucpiodebnoble2.15+dfsg-1ubuntu2.1Not reportedNot reportedNot reported
Ubuntucpiodebpro2.13+dfsg-2ubuntu0.4+esm1Not reportedUBUNTU-CVE-2026-66485Not reported
Ubuntucpiodeb22.042.13+dfsg-7ubuntu0.2Not reportedUBUNTU-CVE-2026-66485Not reported
Ubuntucpiodeb24.042.15+dfsg-1ubuntu2.1Not reportedUBUNTU-CVE-2026-66485Not reported
Ubuntucpiodeb26.042.15+dfsg-2.1ubuntu0.1Not reportedUBUNTU-CVE-2026-66485Not reported

[Debian bug #1144387]

Notes

[trixie] cpio: Minor issue [bookworm] cpio: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [cpio]Affected
    Details (2)

    • 2.13+dfsg-7.1 · amd64 · bookworm

      Affected

      nvd · cpio · debian · bookworm; nvd · cpio · debian · 12

    • 2.13+dfsg-7.1 · arm64 · bookworm

      Affected

      nvd · cpio · debian · bookworm; nvd · cpio · debian · 12

  • [cpio-win32]Affected

    Source package: [cpio]

    Details (2)

    • 2.13+dfsg-7.1 · all · bookworm

      Affected

      nvd · cpio · debian · bookworm; nvd · cpio · debian · 12

    • 2.13+dfsg-7.1 · all · bookworm

      Affected

      nvd · cpio · debian · bookworm; nvd · cpio · debian · 12

[Debian 13 (Trixie)]

  • [cpio]Affected
    Details (2)

    • 2.15+dfsg-2 · amd64 · trixie

      Affected

      nvd · cpio · debian · 13

    • 2.15+dfsg-2 · arm64 · trixie

      Affected

      nvd · cpio · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]