CVE-2021-33644 libtar: out-of-bounds read GNU long-name

CVE-2021-33644 is an out-of-bounds read vulnerability in libtar, a library for parsing and manipulating tar archives. The flaw is triggered when an attacker submits a crafted tar file with the size field in the header struct set to 0. This condition causes malloc(0) to be called for the gnu_longname variable, resulting in an out-of-bounds read beyond allocated memory boundaries. Libtar is widely used in deployment tools, backup utilities, and software package management, making the risk relevant for system administrators.

The official CVSS score is 8.1 (high), indicating significant impact. The vulnerability has been public since August 10, 2022. A relevant signal from a GitHub repository updated on November 4, 2026 indicates an incomplete fix to the previous patch for CVE-2021-33643 and CVE-2021-33644. This data suggests the vulnerability is not yet completely resolved despite patching attempts, maintaining current risk for users running unpatched versions.

Sysadmins must urgently verify which version of libtar is running in production systems, especially in deployment and backup tools. Consult libtar project's official advisories and apply the latest available patch. Implement validation on input tar files and reject files with anomalous header parameters like size 0. Test patches in a controlled environment before production deployment using malformed tar files to validate fix effectiveness.