PT-2026-50415 · Rxi · Microtar
Saidakbarxon Maxsudxonov
·
Published
2026-06-17
·
Updated
2026-06-17
·
CVE-2026-54417
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
An integer overflow in the mtar next() function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. mtar next() computes the offset to the next record as round up(h.size, 512) + sizeof(mtar raw header t) using 32-bit arithmetic. When the header size field is a multiple of 512 in the range 0xFFFFFC01-0xFFFFFE00 (e.g. 0xFFFFFE00), the addition wraps to 0, so mtar next() seeks to the current record position instead of advancing. As a result, mtar find() and any loop that iterates entries with mtar next() repeat indefinitely over the same record, hanging the process at 100% CPU with no recovery.
Fix
Infinite Loop
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Microtar