Heap overflow patched in eradman entr utility
A heap-based buffer overflow in the entr file-watcher tool's run_utility() function can be exploited locally to corrupt memory and crash the process.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-18370, a heap-based buffer overflow in the open-source entr utility developed by eradman. The flaw resides in the run_utility() function, which allocates a fixed-size heap buffer with malloc(ARG_MAX) and copies command-line arguments into it. Because the code advances the destination pointer using the return value of strlcpy() — which reports the total length of the source string rather than the number of bytes actually written — an unsigned size_t underflow occurs once the buffer is exactly filled, causing subsequent writes to go out of bounds.
The vulnerability can be triggered either by supplying command-line arguments whose combined length exactly fills the allocated buffer, or via entr's "/_" substitution feature, which expands a short token into a longer pathname at runtime, indirectly causing the overflow condition. Exploitation requires local access and results in memory corruption, process abort, and denial of service rather than remote code execution or privilege escalation, limiting the practical impact. The issue has been fixed in commit 2467fe0. CERT Polska credited Michał Majchrowicz and Marcin Wyczechowski of AFINE Team for the responsible report through its coordinated vulnerability disclosure process.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/08/CVE-2026-18370
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs