CVE-2026-18370 Heap-based buffer overflow in entr
A local attacker can trigger a heap-based buffer overflow in entr via command-line arguments, causing memory corruption and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-18370?
CVE-2026-18370 is a medium-severity memory corruption vulnerability in eradman entr, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string rather than the number of bytes written. When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing subsequent copies to write out of bounds. This can be triggered by supplying command-line arguments whose combined length fills the buffer, or via the /_ substitution feature which expands a short token into a longer pathname at runtime. The local attacker can cause memory corruption, process abort, and denial of service.
This issue was fixed in commit 2467fe0
Weakness: CWE-122
Which versions are affected by CVE-2026-18370?
How do I fix CVE-2026-18370?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-18370 being exploited?
There is no known exploitation of CVE-2026-18370 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-18370, GHSA-qpgw-rgmq-2367, OESA-2026-3486, OESA-2026-3487, OESA-2026-3488, UBUNTU-CVE-2026-18370.