CVE-2026-66485

GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a...

CVE-2026-66485

GNU cpio is affected by an uncontrolled memory allocation in make_path (src/makepath.c) that uses alloca based on the length of argpath, derived from an archive-controlled pathname during extraction. A crafted cpio archive with a long nested pathname can trigger unbounded stack allocation, causin...