Full Report
Heap-based buffer overflow vulnerability (CVE-2026-18370) has been found in eradman entr software.
Analysis Summary
# Vulnerability: Heap-Based Buffer Overflow in eradman entr
## CVE Details
- **CVE ID**: CVE-2026-18370
- **CVSS Score**: Not explicitly rated in the article (Estimated High severity due to memory corruption and potential for local code execution/DoS)
- **CWE**: CWE-122 (Heap-based Buffer Overflow)
## Affected Systems
- **Products**: eradman `entr` (Event Notify Test Runner)
- **Versions**: All versions through 5.8
- **Configurations**: Systems where `entr` is used to execute utilities based on file changes, particularly those utilizing the `/_` substitution feature.
## Vulnerability Description
The flaw exists within the `run_utility()` function. The application allocates a fixed-size heap buffer using `malloc(ARG_MAX)` to hold command-line arguments. During the copying process, the function advances the destination pointer based on the return value of `strlcpy()`.
Critically, `strlcpy()` returns the length of the *source* string, not the number of bytes actually written to the destination. If a sequence of strings fills the buffer exactly, the calculation for the remaining buffer size underflows (since it is an unsigned `size_t`). This results in a massive positive integer value for the remaining space, allowing subsequent `strlcpy()` calls to write data far beyond the allocated heap boundary.
## Exploitation
- **Status**: PoC details available (Technical description provided by researchers); No confirmed reports of exploitation in the wild.
- **Complexity**: Medium
- **Attack Vector**: Local (The attacker must be able to influence command-line arguments or file pathnames monitored by `entr`).
## Impact
- **Confidentiality**: Low (Possible memory disclosure depending on heap layout)
- **Integrity**: Medium (Memory corruption)
- **Availability**: High (Process abort and Denial of Service)
## Remediation
### Patches
- The issue has been addressed in the source code. Users should update to the latest version or apply **commit 2467fe0**.
- Users of version 5.8 and earlier should upgrade to a version containing the fix (expected to be 5.9 or newer).
### Workarounds
- Avoid using `entr` with untrusted or extremely long file paths.
- Limit the use of the `/_` substitution feature when monitoring directories that may contain deeply nested or long filenames that could exceed `ARG_MAX`.
## Detection
- **Indicators of Compromise**: Unexpected segmentation faults or process crashes of the `entr` utility.
- **Detection Methods**: Security teams can use static analysis tools to flag the misuse of `strlcpy()` return values for pointer arithmetic. Binary auditing tools (like AddressSanitizer) can detect this overflow during testing.
## References
- CERT Polska Advisory: [https://cert[.]pl/en/advisories/CVE-2026-18370]
- CVE Record: [https://www[.]cve[.]org/CVERecord?id=CVE-2026-18370]
- CWE-122 Definition: [https://cwe[.]mitre[.]org/data/definitions/122[.]html]
- Eradman Entr Project: [https://github[.]com/eradman/entr]