GNU cpio patches three archive extraction flaws
CERT Polska coordinated disclosure of three GNU cpio vulnerabilities involving path traversal, stack overflow, and terminal escape injection during archive extraction.
CERT Polska disclosed three vulnerabilities in GNU cpio affecting tar archive extraction and listing functionality, reported by researchers from AFINE Team. CVE-2026-66484 is a path traversal flaw where hard-link targets bypass the --no-absolute-filenames sanitization, allowing a malicious archive to create hard links pointing outside the extraction directory. CVE-2026-66485 is an uncontrolled memory allocation in make_path using alloca on archive-controlled path lengths, enabling a crafted archive to trigger a stack overflow and crash the cpio process (denial of service). CVE-2026-66486 involves improper escaping of member names during cpio -it listing, allowing embedded newlines or ANSI escape sequences to forge listing entries or inject terminal control sequences.
All three issues require a victim to extract or list an attacker-supplied malicious archive; there is no indication of remote network exploitation or active exploitation in the wild. Fixes have been committed upstream for each vulnerability. This is a routine responsible-disclosure advisory affecting a widely-used but low-profile utility, with impact limited to local file-integrity bypass, DoS, and terminal injection scenarios rather than remote code execution.
Mentioned in this report
Detection guidance
cpio Process Crash on Malicious Archive
cpio process terminates abnormally (stack overflow via alloca) when processing a crafted archive with excessive path lengths. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: cpio Process Crash on Malicious Archive
description: Detects abnormal termination of cpio during archive extraction, indicative
of malicious archive triggering stack overflow vulnerability (CVE-2026-66485). Matches
cpio terminating with crash exit code while processing archives.
tags:
- attack.t1204
logsource:
category: process_termination
product: windows
detection:
selection:
Image|endswith: \cpio.exe
ExitCode:
- '-1073741571'
- '-1073741819'
- '-2147483645'
filter_admin_intent:
CommandLine|contains:
- /help
- --version
condition: selection and not filter_admin_intent
falsepositives:
- cpio processing corrupted but legitimate archives with filesystem errors
- Out-of-memory conditions on resource-constrained systems
level: medium
id: fb400814-4cbd-5201-af3b-97490cde1242
status: experimental
author: Vorant
cpio List Mode with Suspicious Output Redirection
cpio -it (list mode) output redirected to file or pipe, enabling capture of terminal-injection sequences from malicious archive member names (CVE-2026-66486). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: cpio List Mode with Suspicious Output Redirection
description: Detects cpio -it listing mode with output redirected to a file or pipe,
which can capture ANSI escape or newline-injection sequences embedded in archive
member names. Generalises on the -it flag and redirection operators rather than
specific payload strings.
tags:
- attack.t1204
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \cpio.exe
CommandLine|contains:
- ' > '
- ' >> '
- ' | '
filter_admin_logging:
ParentImage|endswith:
- \bash.exe
- \cmd.exe
CommandLine|contains:
- 2>&1
condition: selection and not filter_admin_logging
falsepositives:
- System administrators listing archive contents to logs for auditing
- Build scripts capturing cpio inventory for manifest generation
level: low
id: 3f82de5c-3ab8-53c3-9ecb-9674a0f9910b
status: experimental
author: Vorant
cpio Extraction with Hard-Link Traversal
cpio extracting an archive without --no-absolute-filenames flag, permitting hard-link targets to escape the extraction directory (CVE-2026-66484). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: cpio Extraction with Hard-Link Traversal
description: Detects cpio archive extraction (-i flag) executed WITHOUT the --no-absolute-filenames
mitigation, allowing malicious hard-link targets to traverse outside the intended
extraction directory. Matches the absence of the safety flag during extraction.
tags:
- attack.t1204
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \cpio.exe
CommandLine|contains: ' -F '
filter_safe_extraction:
CommandLine|contains: --no-absolute-filenames
filter_stdin_only:
CommandLine|contains: ' -i -d'
condition: selection and not (filter_safe_extraction or filter_stdin_only)
falsepositives:
- Extraction of known-safe archives from trusted sources without explicit safety flags
- Legacy scripts that predate the --no-absolute-filenames mitigation
level: medium
id: bb1c8629-d539-51f3-898b-c5cc3ccc6b89
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/08/CVE-2026-66484
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free