CVE-2021-38185

GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.

• CWE-190
• CWE-190

• https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=dd96882877721703e19272fe25034560b794061bPatch, Third Party Advisory
• https://github.com/fangqyi/cpiopwnExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/06/msg00007.html
• https://lists.gnu.org/archive/html/bug-cpio/2021-08/msg00000.htmlExploit, Mailing List, Vendor Advisory
• https://lists.gnu.org/archive/html/bug-cpio/2021-08/msg00002.htmlExploit, Mailing List, Vendor Advisory
• https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=dd96882877721703e19272fe25034560b794061bPatch, Third Party Advisory
• https://github.com/fangqyi/cpiopwnExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/06/msg00007.html
• https://lists.gnu.org/archive/html/bug-cpio/2021-08/msg00000.htmlExploit, Mailing List, Vendor Advisory
• https://lists.gnu.org/archive/html/bug-cpio/2021-08/msg00002.htmlExploit, Mailing List, Vendor Advisory

Published

Aug 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38179Debug function of Admin UI of SAP Business One Integration i…4.9
• CVE-2021-3818grav is vulnerable to Reliance on Cookies without Validation…5.3
• CVE-2021-38180SAP Business One - version 10.0, allows an attacker to injec…9.8
• CVE-2021-38181SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701,…7.5
• CVE-2021-38182Due to insufficient input validation of Kyma, authenticated …8.8
• CVE-2021-38183SAP NetWeaver - versions 700, 701, 702, 730, does not suffic…6.1
• CVE-2021-38186An issue was discovered in the comrak crate before 0.10.1 fo…6.1
• CVE-2021-38187An issue was discovered in the anymap crate through 0.12.1 f…9.8
• CVE-2021-38188An issue was discovered in the iced-x86 crate through 1.10.3…9.8
• CVE-2021-38189An issue was discovered in the lettre crate before 0.9.6 for…9.8
• CVE-2021-3819firefly-iii is vulnerable to Cross-Site Request Forgery (CSR…8.8
• CVE-2021-38190An issue was discovered in the nalgebra crate before 0.27.1 …9.8