CVE-2026-18370

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18370", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-07-30T10:05:07.781Z", "datePublished": "2026-08-10T12:56:34.454Z", "dateUpdated": "2026-08-10T17:59:10.399Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-08-10T12:56:34.454Z"}, "title": "Heap-based buffer overflow in entr", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-92", "descriptions": [{"lang": "en", "value": "CAPEC-92 Forced Integer Overflow"}]}], "affected": [{"vendor": "eradman", "product": "entr", "repo": "https://github.com/eradman/entr", "programFiles": ["entr.c"], "programRoutines": [{"name": "run_utility()"}], "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "5.8", "changes": [{"at": "commit 2467fe0", "status": "unaffected"}], "versionType": "git"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string rather than the number of bytes written.\u00a0When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing subsequent copies to write out of bounds. This can be triggered by supplying command-line arguments whose combined length fills the buffer, or via the /_ substitution feature which expands a short token into a longer pathname at runtime. The local attacker can cause memory corruption, process abort, and denial of service.\u00a0\n\n\nThis issue was fixed in commit\u00a02467fe0", "supportingMedia": [{"type": "text/html", "base64": false, "value": "entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string rather than the number of bytes written.&nbsp;When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing subsequent copies to write out of bounds. This can be triggered by supplying command-line arguments whose combined length fills the buffer, or via the /_ substitution feature which expands a short token into a longer pathname at runtime. The local attacker can cause memory corruption, process abort, and denial of service.&nbsp;<div><div><br></div><div>This issue was fixed in commit&nbsp;2467fe0</div></div>"}]}], "tags": ["x_open-source"], "references": [{"url": "https://cert.pl/en/posts/2026/08/CVE-2026-18370", "tags": ["third-party-advisory"]}, {"url": "https://eradman.com/entrproject/", "tags": ["product"]}, {"url": "https://github.com/eradman/entr/commit/2467fe0aa5f2b1b074110a9186ef51d35809c9a4", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Micha\u0142 Majchrowicz (AFINE Team)", "type": "finder"}, {"lang": "en", "value": "Marcin Wyczechowski (AFINE Team)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T17:58:59.927778Z", "id": "CVE-2026-18370", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T17:59:10.399Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18370", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T17:58:59.927778Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T17:59:06.960Z"}}], "cna": {"tags": ["x_open-source"], "title": "Heap-based buffer overflow in entr", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Micha\u0142 Majchrowicz (AFINE Team)"}, {"lang": "en", "type": "finder", "value": "Marcin Wyczechowski (AFINE Team)"}], "impacts": [{"capecId": "CAPEC-92", "descriptions": [{"lang": "en", "value": "CAPEC-92 Forced Integer Overflow"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/eradman/entr", "vendor": "eradman", "product": "entr", "versions": [{"status": "affected", "changes": [{"at": "commit 2467fe0", "status": "unaffected"}], "version": "0", "versionType": "git", "lessThanOrEqual": "5.8"}], "programFiles": ["entr.c"], "defaultStatus": "unaffected", "programRoutines": [{"name": "run_utility()"}]}], "references": [{"url": "https://cert.pl/en/posts/2026/08/CVE-2026-18370", "tags": ["third-party-advisory"]}, {"url": "https://eradman.com/entrproject/", "tags": ["product"]}, {"url": "https://github.com/eradman/entr/commit/2467fe0aa5f2b1b074110a9186ef51d35809c9a4", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string rather than the number of bytes written.\u00a0When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing subsequent copies to write out of bounds. This can be triggered by supplying command-line arguments whose combined length fills the buffer, or via the /_ substitution feature which expands a short token into a longer pathname at runtime. The local attacker can cause memory corruption, process abort, and denial of service.\u00a0\n\n\nThis issue was fixed in commit\u00a02467fe0", "supportingMedia": [{"type": "text/html", "value": "entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string rather than the number of bytes written.&nbsp;When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing subsequent copies to write out of bounds. This can be triggered by supplying command-line arguments whose combined length fills the buffer, or via the /_ substitution feature which expands a short token into a longer pathname at runtime. The local attacker can cause memory corruption, process abort, and denial of service.&nbsp;<div><div><br></div><div>This issue was fixed in commit&nbsp;2467fe0</div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-08-10T12:56:34.454Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18370", "state": "PUBLISHED", "dateUpdated": "2026-08-10T17:59:10.399Z", "dateReserved": "2026-07-30T10:05:07.781Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-08-10T12:56:34.454Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "entr", "programFiles": ["entr.c"], "programRoutines": [{"name": "run_utility()"}], "repo": "https://github.com/eradman/entr", "vendor": "eradman", "versions": [{"changes": [{"at": "commit 2467fe0", "status": "unaffected"}], "lessThanOrEqual": "5.8", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string rather than the number of bytes written.\u00a0When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing subsequent copies to write out of bounds. This can be triggered by supplying command-line arguments whose combined length fills the buffer, or via the /_ substitution feature which expands a short token into a longer pathname at runtime. The local attacker can cause memory corruption, process abort, and denial of service.\u00a0\n\n\nThis issue was fixed in commit\u00a02467fe0"}, {"lang": "es", "value": "entr es vulnerable a desbordamiento de b\u00fafer basado en mont\u00edculo en la funci\u00f3n run_utility(). La funci\u00f3n asigna un b\u00fafer de mont\u00edculo de tama\u00f1o fijo usando malloc(ARG_MAX) y copia argumentos de l\u00ednea de comandos en \u00e9l. Avanza el puntero de destino bas\u00e1ndose en el valor de retorno de strlcpy(), que devuelve la longitud total de la cadena de origen en lugar del n\u00famero de bytes escritos. Cuando el b\u00fafer se llena exactamente, el tama\u00f1o restante se desborda negativamente como un size_t sin signo, haciendo que las copias subsiguientes escriban fuera de los l\u00edmites. Esto puede ser provocado por el suministro de argumentos de l\u00ednea de comandos cuya longitud combinada llena el b\u00fafer, o a trav\u00e9s de la caracter\u00edstica de sustituci\u00f3n /_ que expande un token corto en un nombre de ruta m\u00e1s largo en tiempo de ejecuci\u00f3n. El atacante local puede causar corrupci\u00f3n de memoria, aborto de proceso y denegaci\u00f3n de servicio.\n\nEste problema fue solucionado en el commit 2467fe0"}], "id": "CVE-2026-18370", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18370", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T17:58:59.927778Z", "version": "2.0.3"}}]}, "published": "2026-08-10T13:17:58.397", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2026/08/CVE-2026-18370"}, {"source": "cvd@cert.pl", "url": "https://eradman.com/entrproject/"}, {"source": "cvd@cert.pl", "url": "https://github.com/eradman/entr/commit/2467fe0aa5f2b1b074110a9186ef51d35809c9a4"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{"bugzilla": {"description": "entr: entr: Heap-based buffer overflow leads to denial of service", "id": "2513487", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513487"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string rather than the number of bytes written.\u00a0When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing subsequent copies to write out of bounds. This can be triggered by supplying command-line arguments whose combined length fills the buffer, or via the /_ substitution feature which expands a short token into a longer pathname at runtime. The local attacker can cause memory corruption, process abort, and denial of service.\u00a0\nThis issue was fixed in commit\u00a02467fe0", "A flaw was found in entr. A local attacker can exploit a heap-based buffer overflow in the `run_utility()` function by supplying specially crafted command-line arguments or using the `/_` substitution feature. This can lead to memory corruption, causing a process abort and a denial of service (DoS)."], "mitigation": {"lang": "en:us", "value": "Update to a fixed version of entr that includes the patch from commit 2467fe0."}, "name": "CVE-2026-18370", "public_date": "2026-08-10T12:56:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-18370\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-18370\nhttps://cert.pl/en/posts/2026/08/CVE-2026-18370\nhttps://eradman.com/entrproject/\nhttps://github.com/eradman/entr/commit/2467fe0aa5f2b1b074110a9186ef51d35809c9a4"], "statement": "The entr package is not shipped in any Red Hat product. This issue only affects the Fedora community package.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.8]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "entr", "source": "cna", "vendor": "eradman"}, "product": "entr", "vendor": "eradman"}], "created": "2026-08-10T18:30:04.229723+00:00", "updated": "2026-08-14T02:15:03.115619+00:00", "vendors": ["eradman", "eradman$PRODUCT$entr"]}