Description
unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
selmf unarr
Default version status: unaffected
0 to ≤ 1.1.1affected
pkg:github/selmf/unarrReferences
- https://hackmd.io/@haind-pwn/unarr-tar-zip-oob ↗
- https://github.com/selmf/unarr/blob/b211040df83dee513362cdeb9bd87afa26fd5e38/tar/parse-tar.c#L242-L254 ↗
- https://github.com/selmf/unarr ↗
- https://www.vulncheck.com/advisories/unarr-through-1.1.1-off-by-one-heap-buffer-overflow-via-tar-get-name ↗
- https://hackmd.io/@haind-pwn/cve-2026-111273-111274-unarr-tar-zip-oob ↗