CVE-2026-66485

A flaw was found in GNU cpio. This vulnerability involves uncontrolled memory allocation when processing specially crafted cpio archives. A remote attacker could exploit this by providing a malicious archive, leading to a stack overflow and causing the cpio process to crash. This results in a denial of service (DoS) for the affected system.

GNU cpio's make_path() uses alloca() to allocate stack memory sized from an archive-controlled pathname during extraction. A crafted archive with a sufficiently long nested pathname causes unbounded stack allocation, crashing the cpio process. All Red Hat cpio packages (RHEL 6 through 10, RHIVOS) ship versions well below the fix and are affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users should avoid extracting cpio archives from untrusted sources.