Skip to content

Product

azure linux cpio vulnerabilities

3 published CVES affecting azure linux cpio, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
0
Medium
3
Low
0
Unscored
0
CISA KEV
0

Latest azure linux cpio CVEs

Newest publication first

  1. CVE-2026-66486 Improper Output Encoding in GNU cpio

    Published
    MediumCVSS 4.6 EPSS 0.18%

    GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing membe...

  2. CVE-2026-66485 Uncontrolled Memory Allocation in GNU cpio

    Published
    MediumCVSS 4.6 EPSS 0.19%

    GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio arch...

  3. CVE-2026-66484 Path Traversal in GNU cpio

    Published
    MediumCVSS 4.6 EPSS 0.20%

    GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name fu...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.