CVE-2026-54417 Integer Overflow in rxi/microtar mtar_next() Causes Infinite Loop DoS
A remote attacker can cause a denial of service via infinite loop in the microtar library by submitting a crafted tar archive exploiting an integer overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54417?
CVE-2026-54417 is a high-severity vulnerability in rxi microtar, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. mtar_next computes the offset to the next record as round_up(h.size, 512) + sizeof(mtar_raw_header_t) using 32-bit arithmetic.
Which versions are affected by CVE-2026-54417?
How do I fix CVE-2026-54417?
No fix has been published for CVE-2026-54417 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-54417 being exploited?
There is no known exploitation of CVE-2026-54417 in the wild and no public exploit code.
Sources
Also known as GHSA-w3fj-cqg8-8572.