Skip to content

Security Issue Report #5084

Closed
Bug
#5089
Closed
Security Issue Report#5084
Bug
#5089
Labels
area: vfsVirtual File System supportprio: mediumHas the potential to affect progress
Milestone
4.9.0

Description

@mmajchr
mmajchr
opened on Apr 1, 2026

Is there an existing issue for this?

  • I have searched the existing issues

Midnight Commander version and build configuration

Hello mc maintainers.
How can I safely report a security issue in mc?
I don't want to reveal sensitive info in public GitHub issue.
Regards.

Operating system

Linux

Is this issue reproducible using the latest version of Midnight Commander?

  • I confirm the issue is still reproducible with the latest version of Midnight Commander

How to reproduce

.

Expected behavior

Some info on website or SECURITY.md on GitHub.

Actual behavior

No SECURITY.md

Additional context

No response

Activity

  1. mmajchr
    added the
    Bug
    issue type on Apr 1, 2026
  2. mmajchr
    added
    prio: mediumHas the potential to affect progress
    needs triageNeeds triage by maintainers
    on Apr 1, 2026
  3. github-actions
    added this to the Future Releases milestone on Apr 1, 2026

  4. zyv commented on Apr 1, 2026

    @zyv
    zyv
    on Apr 1, 2026
    Member

    You can report privately to the current maintainers:

    https://midnight-commander.org/maintainers/#current-team

  5. zyv
    added
    area: vfsVirtual File System support
    and removed
    needs triageNeeds triage by maintainers
    on Apr 6, 2026
  6. zyv
    modified the milestones: Future Releases, 4.9.0 on Apr 6, 2026

  7. zyv commented on Apr 6, 2026

    @zyv
    zyv
    on Apr 6, 2026
    Member

    Our severity assessment: a practically non-exploitable crash when entering crafted CPIO archives, that is, local DoS.

  8. zyv
    added a commit that references this issue on Apr 6, 2026

    Ticket MidnightCommander#5084: fix integer overflow in binary CPIO ha…

    3caddc1
  9. sectroyer
    added a commit that references this issue on Apr 23, 2026

    Ticket MidnightCommander#5084: fix integer overflow in binary CPIO ha…

    d20099c
  10. sectroyer
    added 2 commits that reference this issue on May 11, 2026

    Ticket MidnightCommander#5084: fix integer overflow in binary CPIO ha…

    f77c3fc

    Ticket MidnightCommander#5084: fix integer overflow in binary CPIO ha…

    12060a5
  11. mc-worker
    marked Missing Input Validation in MC cpio VFS Handler #5117 as a duplicate of this issue on May 12, 2026
  12. zyv
    added 3 commits that reference this issue on Oct 10, 2026

    Ticket MidnightCommander#5084: fix integer overflow in binary CPIO ha…

    0cd7a16

    Ticket MidnightCommander#5084: tests: add cpiofs tests for symlink ta…

    cb7c463

    Ticket MidnightCommander#5084: tests: add cpiofs tests for symlink ta…

    3a73f36
  13. zyv
    closed this as completedin #5089on Oct 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: vfsVirtual File System supportprio: mediumHas the potential to affect progress

    Type

    Bug

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions