Skip to content
Fencer Intel
medium 4.6

CVE-2026-66486 json

Improper Output Encoding in GNU cpio

published 3mo ago modified 18d ago also EUVD-2026-55244

cvss
4.6
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.

This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

Patch / fix

  • cpio Ubuntu 22.04 LTS 2.13+dfsg-7ubuntu0.2
  • cpio Ubuntu 24.04 LTS 2.15+dfsg-1ubuntu2.1
  • cpio Ubuntu 26.04 LTS 2.15+dfsg-2.1ubuntu0.1
  • cpio Ubuntu Pro 14.04 LTS 2.11+dfsg-1ubuntu1.2+esm3
  • cpio Ubuntu Pro 16.04 LTS 2.11+dfsg-5ubuntu1.1+esm2
  • cpio Ubuntu Pro 18.04 LTS 2.12+dfsg-6ubuntu0.18.04.4+esm1
  • cpio Ubuntu Pro 20.04 LTS 2.13+dfsg-2ubuntu0.4+esm1

ubuntu advisories UBUNTU-CVE-2026-66486

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cpio SLE Module for Basesystem 15 SP7, SLE Micro 5.5, SLE Micro 5.4 +1 more 2.13-150400.3.10.1
  • cpio SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.15-160000.3.1
  • cpio Linux Micro 6.0 2.15-2.1
  • cpio Linux Micro 6.1 2.15-slfo.1.1_3.1
  • cpio SLES LTSS Extended Security 12 SP5 2.11-36.25.1

suse advisories SUSE-SU-2026:4012-1SUSE-SU-2026:23464-1SUSE-SU-2026:23612-1SUSE-SU-2026:3959-1SUSE-SU-2026:23441-1SUSE-SU-2026:23355-1

  • cpio openSUSE Leap 16.0 2.15-160000.3.1
  • cpio openSUSE Tumbleweed 2.15-8.1

opensuse advisories openSUSE-SU-2026:21747-1openSUSE-SU-2026:11618-1

  • cpio Azure Linux 3.0 2.14-2

azure linux advisories AZL-94689

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-66486 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-66486 updated cvss 6.1

cpio: GNU cpio: Terminal control sequence injection via crafted archive member names

  • Red Hat Enterprise Linux 6 cpio 2.15-3.el10 Red Hat Enterprise Linux 7 cpio, cpio 2.15-3.el10 Red Hat Enterprise Linux 8 cpio, cpio 2.15-3.el10 Red Hat Enterprise Linux 9 cpio 2.15-3.el10 Red Hat Enterprise Linux 10 cpio 2.15-3.el10
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images cpio 2.15-3.el10
    affected: workaround, no fix available

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3mo ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 4.0 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • GNU cpio

Classification

Weakness
  • CWE-116 Improper Encoding or Escaping of Output

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.