CVE-2026-43623: microtar 0.1.0 Stack-Based Buffer Overflow via raw_to_header()

Synopsis

A stack-based buffer overflow exists in microtar 0.1.0, specifically in the raw_to_header() function in src/microtar.c. The flaw is reachable over the network and requires no authentication, but does require a victim to open or process a crafted TAR archive; an attacker supplies a malicious archive with non-null-terminated name or linkname fields, causing strcpy() to write up to 355 bytes into a 100-byte stack buffer. Successful exploitation gives the attacker full control over adjacent stack memory, enabling arbitrary code execution, data disclosure, or a service crash. No upstream fix has been published; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver a crafted TAR archive to the target over the network, requiring the vulnerable service to be reachable remotely.

• AuthenticationNot required

  No credentials or account are needed; the attacker only needs to supply a malicious TAR file to the processing endpoint.

• Victim interactionRequired

  A user or automated process must open, scan, or otherwise process the attacker-supplied TAR archive via mtar_open(), mtar_find(), or mtar_read_header().

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions or special memory-layout prerequisites are required to trigger the overflow.

Blast Radius

• Reads arbitrary memory from the stack of the processing application, potentially exposing in-memory secrets, session tokens, or cryptographic material.
• Overwrites adjacent stack frames with attacker-controlled bytes, enabling arbitrary code execution in the context of the process handling the TAR archive.
• Corrupts stack canaries or return addresses in a way that crashes the affected service, causing a denial of service for any workload relying on microtar for archive processing.
• Compromises both the confidentiality and integrity of data handled by the affected process, including file paths, metadata, and any content extracted from TAR archives.