Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-4424

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial

Summary

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: partial

  3. Record last updated

Affected versions

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • libarchive

    Version range not reported

  • openshift/ose-rhel-coreos-8

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

  • rhpam-7/rhpam-businesscentral-monitoring-rhel8

    Version range not reported

  • rhpam-7/rhpam-businesscentral-rhel8

    Version range not reported

  • rhpam-7/rhpam-controller-rhel8

    Version range not reported

  • rhpam-7/rhpam-dashbuilder-rhel8

    Version range not reported

  • rhpam-7/rhpam-kieserver-rhel8

    Version range not reported

  • rhpam-7/rhpam-process-migration-rhel8

    Version range not reported

  • rhpam-7/rhpam-smartrouter-rhel8

    Version range not reported

  • cert-manager/jetstack-cert-manager-acmesolver-rhel9

    Version range not reported

  • cert-manager/jetstack-cert-manager-rhel9

    Version range not reported

  • cert-manager/cert-manager-operator-rhel9

    Version range not reported

  • cert-manager/cert-manager-operator-bundle

    Version range not reported

  • cert-manager/jetstack-cert-manager-acmesolver-rhel9

    Version range not reported

  • cert-manager/jetstack-cert-manager-rhel9

    Version range not reported

  • cert-manager/cert-manager-istio-csr-rhel9

    Version range not reported

  • cert-manager/cert-manager-operator-rhel9

    Version range not reported

  • cert-manager/cert-manager-operator-bundle

    Version range not reported

  • cert-manager/cert-manager-trust-manager-rhel9

    Version range not reported

  • rhaiis/vllm-cuda-rhel9

    Version range not reported

  • rhaiis/vllm-rocm-rhel9

    Version range not reported

  • rhaiis/model-opt-cuda-rhel9

    Version range not reported

  • rhaiis/model-opt-cuda-rhel9

    Version range not reported

  • rhaiis/vllm-rocm-rhel9

    Version range not reported

  • rhaiis/vllm-cuda-rhel9

    Version range not reported

  • rhaiis/vllm-spyre-rhel9

    Version range not reported

  • discovery/discovery-server-rhel9

    Version range not reported

  • discovery/discovery-ui-rhel9

    Version range not reported

  • libarchive-main

    Version range not reported

  • insights-proxy/insights-proxy-container-rhel9

    Version range not reported

  • rhui5/cds-rhel9

    Version range not reported

  • rhui5/haproxy-rhel9

    Version range not reported

  • rhui5/installer-rhel9

    Version range not reported

  • rhui5/rhua-rhel9

    Version range not reported

  • rhui5/cds-kubernetes-tp-rhel9

    Version range not reported

  • rhui5/installer-tp-rhel9

    Version range not reported

  • rhui5/rhua-tp-rhel9

    Version range not reported

  • libarchive

    Version range not reported

References 25

access.redhat.com