{"id":"CVE-2026-126831","kind":"vulnerability","aliases":["CVE-2026-126831"],"related":[],"title":"cpio: long owner or group names crash archive creation in tar mode","description":"A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash.","summary":"A stack buffer overflow in cpio occurs when archiving files whose owner or group names exceed 32 characters while writing tar or ustar formats. The unbounded copy corrupts stack memory and crashes the program.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cpio","infrastructure","linux","unix"],"not_affected_if":["no-local-users","no-tar-or-ustar-archiving"],"how_to_check":"- Run `cpio --version` to see which version is installed.\n- Check whether any scripts or backups run `cpio` with `-H tar` or `-H ustar` on files with long user or group names.","fix":null,"status":"open","published_at":"2026-11-12T18:17:28+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","triaged_at":"2026-11-12T18:43:03+00:00","updated_at":"2026-11-12T18:43:03+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T18:43:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"cpio: long owner or group names crash archive creation in tar mode","impact":"low","summary":"A stack buffer overflow in cpio occurs when archiving files whose owner or group names exceed 32 characters while writing tar or ustar formats. The unbounded copy corrupts stack memory and crashes the program.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cpio","linux","unix"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Denial of service: cpio crashes while archiving the affected files.","analyst_note":"","how_to_check":"- Run `cpio --version` to see which version is installed.\n- Check whether any scripts or backups run `cpio` with `-H tar` or `-H ustar` on files with long user or group names.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-local-users","no-tar-or-ustar-archiving"],"who_is_affected":"Only local users who can run cpio to create tar or ustar archives of files with long owner or group names can trigger the crash. The sources describe a denial of service, not code execution. Systems that never run cpio in these formats can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":4555,"output_tokens":463,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126831':15A,18A '-2026':14A,17A '32':39B,100C 'applic':124C 'archiv':8A,31B,83C,90C 'base':78C 'buffer':25B,79C 'caus':67C,122C 'charact':40B,101C 'copi':49B,103C,117C 'corrupt':50B,118C 'cpio':1A,19B,28B,62C,102C 'crash':7A,54B,126C 'creat':82C 'creation':9A 'cve':13A,16A 'denial':69C 'dos':72C 'exceed':38B,99C 'file':32B,91C 'fix':108C 'fixed-s':107C 'flaw':58C 'format':46B,88C 'found':60C 'group':5A,36B,96C 'infrastructur':20B 'length':114C 'linux':21B 'local':64C 'long':2A 'memori':52B,110C,120C 'mode':12A 'name':6A,37B,98C,105C 'occur':29B 'overflow':26B,80C 'own':92C 'owner':3A,34B 'program':56B 'servic':71C 'size':109C 'stack':24B,51B,77C,119C 'stack-bas':76C 'tar':11A,43B,85C 'trigger':74C 'unbound':48B,116C 'unix':22B 'user':65C,94C 'ustar':45B,87C 'verifi':112C 'whose':33B 'without':111C 'write':42B","nicknames":[],"mitigations":[],"who_affected":"Only local users who can run cpio to create tar or ustar archives of files with long owner or group names can trigger the crash. The sources describe a denial of service, not code execution. Systems that never run cpio in these formats can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cpio","infrastructure","linux","medium","unix"],"campaign_type":null,"search_a":"'-126831':15A,18A '-2026':14A,17A 'archiv':8A 'cpio':1A 'crash':7A 'creation':9A 'cve':13A,16A 'group':5A 'long':2A 'mode':12A 'name':6A 'owner':3A 'tar':11A","search_b":"'32':39B 'archiv':31B 'buffer':25B 'charact':40B 'copi':49B 'corrupt':50B 'cpio':19B,28B 'crash':54B 'exceed':38B 'file':32B 'format':46B 'group':36B 'infrastructur':20B 'linux':21B 'memori':52B 'name':37B 'occur':29B 'overflow':26B 'owner':34B 'program':56B 'stack':24B,51B 'tar':43B 'unbound':48B 'unix':22B 'ustar':45B 'whose':33B 'write':42B","search_c":"'32':100C 'applic':124C 'archiv':83C,90C 'base':78C 'buffer':79C 'caus':67C,122C 'charact':101C 'copi':103C,117C 'corrupt':118C 'cpio':62C,102C 'crash':126C 'creat':82C 'denial':69C 'dos':72C 'exceed':99C 'file':91C 'fix':108C 'fixed-s':107C 'flaw':58C 'format':88C 'found':60C 'group':96C 'length':114C 'local':64C 'memori':110C,120C 'name':98C,105C 'overflow':80C 'own':92C 'servic':71C 'size':109C 'stack':77C,119C 'stack-bas':76C 'tar':85C 'trigger':74C 'unbound':116C 'user':65C,94C 'ustar':87C 'verifi':112C 'without':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126831","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126831","severity":null,"published_at":"2026-11-12T18:17:28+00:00","modified_at":"2026-11-12T18:17:28+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","fetched_at":"2026-11-12T18:40:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}