Hello and sorry for the late reply, thank you for the report. By the way: On Sat, Oct 31, 2026 at 07:20:29AM +0000, apex-security-research wrote: > There is no CVE for this root; CVE-2026-5704 is the typeflag one. I am happy > to > request one, or to leave it to you. If one is requested, Vahagn Vardanian > reported this root first and should be named as the reporter.
Not sure what you mean by "for this root", but FYI we (Red Hat) reserved CVE-2026-18082 for this problem that Vahagn Vardanian found, it is just not published yet, so you don't see it. I believe the severity should be same as for CVE-2026-5704, which has a very similar impact, I would not call it a RCE (contrary to the original report). I am not a maintainer of GNU tar so I can not comment on the suitability of the patches for inclusion. Regards, Pavel Cahyna
