It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the extraction directory, even when using the --no-absolute-filenames option. ( CVE-2026-66484 ) It was discovered that cpio did not properly bound the stack memory allocated for pathnames during archive extraction. If a user or automated system were tricked into extracting a specially crafted cpio archive, an attacker could possibly use this issue to cause cpio to crash, resulting in a denial of service. ( CVE-2026-66485 ) It was discovered that cpio did not properly escape archive member names when listing archive contents. If a user or automated system were...
It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the extraction directory, even when using the --no-absolute-filenames option. ( CVE-2026-66484 )
It was discovered that cpio did not properly bound the stack memory allocated for pathnames during archive extraction. If a user or automated system were tricked into extracting a specially crafted cpio archive, an attacker could possibly use this issue to cause cpio to crash, resulting in a denial of service. ( CVE-2026-66485 )
It was discovered that cpio did not properly escape archive member names when listing archive contents. If a user or automated system were...
It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the extraction directory, even when using the --no-absolute-filenames option. ( CVE-2026-66484 ) It was discovered that cpio did not properly bound the stack memory allocated for pathnames during archive extraction. If a user or automated system were tricked into extracting a specially crafted cpio archive, an attacker could possibly use this issue to cause cpio to crash, resulting in a denial of service. ( CVE-2026-66485 ) It was discovered that cpio did not properly escape archive member names when listing archive contents. If a user or automated system were tricked into listing a specially crafted archive, an attacker could possibly use this issue to inject misleading output or malicious terminal control sequences. ( CVE-2026-66486 )
It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the extraction directory, even when using the --no-absolute-filenames option. ( CVE-2026-66484 )
It was discovered that cpio did not properly bound the stack memory allocated for pathnames during archive extraction. If a user or automated system were tricked into extracting a specially crafted cpio archive, an attacker could possibly use this issue to cause cpio to crash, resulting in a denial of service. ( CVE-2026-66485 )
It was discovered that cpio did not properly escape archive member names when listing archive contents. If a user or automated system were tricked into listing a specially crafted archive, an attacker could possibly use this issue to inject misleading output or malicious terminal control sequences. ( CVE-2026-66486 )
In general, a standard system update will make all the necessary changes.
The problem can be corrected by updating your system to the following package versions:
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
