Heap overflow patched in eradman entr utility

A heap-based buffer overflow in the entr file-watcher tool's run_utility() function can be exploited locally to corrupt memory and crash the process.

CERT Polska coordinated disclosure of CVE-2026-18370, a heap-based buffer overflow in the open-source entr utility developed by eradman. The flaw resides in the run_utility() function, which allocates a fixed-size heap buffer with malloc(ARG_MAX) and copies command-line arguments into it. Because the code advances the destination pointer using the return value of strlcpy() — which reports the total length of the source string rather than the number of bytes actually written — an unsigned size_t underflow occurs once the buffer is exactly filled, causing subsequent writes to go out of bounds.

The vulnerability can be triggered either by supplying command-line arguments whose combined length exactly fills the allocated buffer, or via entr's "/_" substitution feature, which expands a short token into a longer pathname at runtime, indirectly causing the overflow condition. Exploitation requires local access and results in memory corruption, process abort, and denial of service rather than remote code execution or privilege escalation, limiting the practical impact. The issue has been fixed in commit 2467fe0. CERT Polska credited Michał Majchrowicz and Marcin Wyczechowski of AFINE Team for the responsible report through its coordinated vulnerability disclosure process.

Source reporting: https://cert.pl/en/posts/2026/08/CVE-2026-18370