GNU Tar & Bison: Four Moderate Flaws Disclosed Together Allow File Overwrites and Code Execution
Key findings • Four moderate-severity vulnerabilities disclosed in GNU tar and bison between July 30-31, 2026. • GNU tar vulnerabilities (CVE-2026-18508, CVE-2026-18477) allow arbitrary file …
Key findings
- Four moderate-severity vulnerabilities disclosed in GNU tar and bison between July 30-31, 2026.
- GNU tar vulnerabilities (CVE-2026-18508, CVE-2026-18477) allow arbitrary file overwrite and path escapes.
- GNU bison vulnerabilities (CVE-2026-56390, CVE-2026-56389) permit arbitrary file redirection and code execution.
- Debian-specific details noted for bison flaws, highlighting potential impact on Debian-based systems.
On July 30-31, 2026, a batch of four moderate-severity vulnerabilities was disclosed across two GNU utilities: tar and bison. The disclosures, spanning just 14 hours, highlight issues related to file path manipulation and arbitrary code execution within these foundational tools. These vulnerabilities, if exploited, could allow attackers to overwrite arbitrary files or execute commands on affected systems, posing a risk to data integrity and system security.
The tar utility, a long-standing archiving tool, is affected by two distinct issues. CVE-2026-18508, a hardlink target confinement issue within the --one-top-level option, could enable arbitrary file overwrites by manipulating hardlinks. Similarly, CVE-2026-18477 describes a Time-of-Check to Time-of-Use (TOCTOU) race condition in incremental dumpdir rename handling, which could lead to a path escape during restore operations. Both tar vulnerabilities were published on July 31, 2026.
The GNU bison parser generator, used in the build process for many software projects, is impacted by two vulnerabilities disclosed on July 30, 2026. CVE-2026-56390 details how bison improperly handles grammar-defined output paths, allowing attackers to redirect generated files to arbitrary locations when processing malicious grammar files. Furthermore, CVE-2026-56389 points to an arbitrary program execution flaw during HTML report generation. This occurs because a grammar file can override the executable used for the XML-to-HTML transformation step, enabling the execution of attacker-chosen programs.
The disclosures for bison specifically mention Debian's packaging of the tool, indicating that users of Debian-based systems may be particularly exposed if they haven't updated their bison packages. While no specific threat actors or in-the-wild exploitation have been reported for this batch, the nature of these vulnerabilities—arbitrary file overwrite and arbitrary code execution—warrants prompt attention from users and administrators.
Details regarding specific affected versions and patch availability were not immediately detailed in the initial disclosures. However, given the nature of these vulnerabilities, it is strongly recommended that users of GNU tar and bison, especially those on Debian systems, consult the official GNU project advisories and their respective distribution's security updates to apply patches as soon as they become available. Proactive updating is the most effective mitigation against these types of flaws.
This batch of vulnerabilities underscores the ongoing need for vigilance even with mature and widely-used software components like those in the GNU toolchain. Users should remain aware of security advisories and prioritize patching to protect against potential exploitation. The coordinated disclosure of these issues allows defenders a window to prepare and mitigate risks before widespread exploitation can occur.