CVE-2026-18370

{
  "id": "CVE-2026-18370",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-10T13:17:58.397",
  "lastModified": "2026-10-23T20:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string rather than the number of bytes written. When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing subsequent copies to write out of bounds. This can be triggered by supplying command-line arguments whose combined length fills the buffer, or via the /_ substitution feature which expands a short token into a longer pathname at runtime. The local attacker can cause memory corruption, process abort, and denial of service. \n\n\nThis issue was fixed in commit 2467fe0"
    },
    {
      "lang": "es",
      "value": "entr es vulnerable a desbordamiento de búfer basado en montículo en la función run_utility(). La función asigna un búfer de montículo de tamaño fijo usando malloc(ARG_MAX) y copia argumentos de línea de comandos en él. Avanza el puntero de destino basándose en el valor de retorno de strlcpy(), que devuelve la longitud total de la cadena de origen en lugar del número de bytes escritos. Cuando el búfer se llena exactamente, el tamaño restante se desborda negativamente como un size_t sin signo, haciendo que las copias subsiguientes escriban fuera de los límites. Esto puede ser provocado por el suministro de argumentos de línea de comandos cuya longitud combinada llena el búfer, o a través de la característica de sustitución /_ que expande un token corto en un nombre de ruta más largo en tiempo de ejecución. El atacante local puede causar corrupción de memoria, aborto de proceso y denegación de servicio.\n\nEste problema fue solucionado en el commit 2467fe0"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "eradman",
          "product": "entr",
          "defaultStatus": "unaffected",
          "programFiles": [
            "entr.c"
          ],
          "programRoutines": [
            {
              "name": "run_utility()"
            }
          ],
          "repo": "https://github.com/eradman/entr",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "5.8",
              "versionType": "git",
              "status": "affected",
              "changes": [
                {
                  "at": "commit 2467fe0",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-10T17:58:59.927778Z",
          "id": "CVE-2026-18370",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cert.pl/en/posts/2026/08/CVE-2026-18370",
      "source": "[email protected]"
    },
    {
      "url": "https://eradman.com/entrproject/",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/eradman/entr/commit/2467fe0aa5f2b1b074110a9186ef51d35809c9a4",
      "source": "[email protected]"
    }
  ]
}