---
id: "CVE-2026-126831"
page: "https://infrastack.ai/live/CVE-2026-126831"
kind: "vulnerability"
aliases: ["CVE-2026-126831"]
title: "cpio: long owner or group names crash archive creation in tar mode"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["cpio", "infrastructure", "linux", "unix"]
not_affected_if: ["no-local-users", "no-tar-or-ustar-archiving"]
published_at: "2026-11-12T18:17:28+00:00"
first_seen_at: "2026-11-12T18:40:39+00:00"
updated_at: "2026-11-12T18:43:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126831", "first_seen_at": "2026-11-12T18:40:39+00:00"}]
exploit_sources: []
---

# cpio: long owner or group names crash archive creation in tar mode

Link for people: https://infrastack.ai/live/CVE-2026-126831 (this .md is for agents)

A stack buffer overflow in cpio occurs when archiving files whose owner or group names exceed 32 characters while writing tar or ustar formats. The unbounded copy corrupts stack memory and crashes the program.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `cpio --version` to see which version is installed.
- Check whether any scripts or backups run `cpio` with `-H tar` or `-H ustar` on files with long user or group names.

## Timeline

- 2026-11-12T18:40:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126831

## From the sources

A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_