Thank you. That reply corrects two things I had wrong, and I would rather say so on the list than leave them standing.
1. "There is no CVE for this root" was wrong, and I will not request one. CVE-2026-18082 covers it. A reserved but unpublished CVE is not visible from outside, which is my problem to account for and not yours; the sentence should have read "no CVE is published for this". 2. "Root" was my own jargon for "this specific defect" -- the desynchronised sparse map, as against the typeflag bug in CVE-2026-5704. I will write plainly next time. On severity I have no disagreement. I made no RCE claim. What I measured and reported is narrower: one crafted member makes "tar -tf" and "tar -xf" describe different archives, and both exit 0 with no message. Same impact band as CVE-2026-5704 reads right to me. The credit belongs to Vahagn Vardanian, as in my first mail. One correction I owe separately, to the list rather than to you. On 31 October I wrote to Paul Eggert directly with "(list copy did not arrive)" in the subject, because a third-party mail mirror had not picked up my post. That was a false negative on my side: the post is in the GNU archive at bug-tar/2026-10/msg00015.html, with the timestamp I sent it. If anyone now holds it twice, it is one finding and not two. That leaves the patch itself with no comment from someone who can merge it. It is in the archived message, against master, for whenever a maintainer has time. No reply is needed on my account. Apex Security Research [email protected]
