PT-2026-50415 · Microtar · Microtar

Saidakbarxon Maxsudxonov · CVE-2026-54417 · Published 2026-06-17 · Updated 2026-06-17

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions rxi microtar version 0.1.0

Description An integer overflow occurs in the mtar next() function within src/microtar.c. The function calculates the offset to the next record using 32-bit arithmetic. When the header size field is a multiple of 512 within the range 0xFFFFFC01-0xFFFFFE00, the addition wraps to 0, causing mtar next() to seek to the current record position rather than advancing. This leads to an infinite loop in mtar find() or any loop iterating entries with mtar next(), resulting in a denial of service characterized by uncontrolled CPU consumption at 100% with no recovery when processing a crafted tar archive.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Infinite Loop

Integer Overflow

Weakness Enumeration

CWE-835

CWE-190

Related Identifiers

CVE-2026-54417

Affected Products

Microtar

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54417.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-54417 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54417 · Security Note
• https://github.com/rxi/microtar/blob/master/src/microtar.c#L239 · Note
• https://github.com/rxi/microtar · Note
• https://t.me/CVEtracker/57116 · Telegram Post
• https://raw.githubusercontent.com/rxi/microtar/master/src/microtar.c · Note